Hello community, here is the log from the commit of package cilium for openSUSE:Factory checked in at 2020-08-06 17:29:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cilium (Old) and /work/SRC/openSUSE:Factory/.cilium.new.3399 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cilium" Thu Aug 6 17:29:53 2020 rev:28 rq:824205 version:1.7.6 Changes: -------- --- /work/SRC/openSUSE:Factory/cilium/cilium.changes 2020-06-23 21:02:46.669491238 +0200 +++ /work/SRC/openSUSE:Factory/.cilium.new.3399/cilium.changes 2020-08-06 17:30:32.789072022 +0200 @@ -1,0 +2,42 @@ +Mon Aug 3 16:53:32 UTC 2020 - Callum Farmer <callumjfarme...@gmail.com> + +- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) + +------------------------------------------------------------------- +Thu Jul 30 10:15:01 UTC 2020 - Dirk Mueller <dmuel...@suse.com> + +- update to 1.7.6: + Fixes https://github.com/cilium/cilium/security/advisories/GHSA-9hx8-3wfx-q2vw + (CVE-2020-8663, CVE-2020-12605, CVE-2020-12604, CVE-2020-12603, bsc#1173559) + + see https://github.com/cilium/cilium/releases/tag/v1.7.6 + * avoid having endpoints in 'restoring' state in case the connectivity with the KVStore is not reliable (Backport PR #12333, Upstream PR #12307, @aanm) + * bpf: Use nproc --all for __NR_CPUS__ (Backport PR #12363, Upstream PR #12121, @gandro) + * cilium: fix encryption flow labels in ip6 case (Backport PR #12056, Upstream PR #12015, @jrfastab) + * Fix bug where etcd session renew would block indefinitely, causing endpoint provision to fail (Backport PR #12333, Upstream PR #12292, @joestringer) + * Fix bug where identity allocation wouldn't cancel from api timeouts (Backport PR #12350, Upstream PR #12328, @joestringer) + * Fix setting monitorAggregationLevel to max reflects via CLI (Backport PR #12333, Upstream PR #12014, @soumynathan) + * Fix silent cilium monitor on systems with offline CPUs (Backport PR #12363, Upstream PR #12310, @pchaigno) + * Fix syslog hook missing in DefaultLogger (Backport PR #12333, Upstream PR #12170, @ArthurChiao) + * helm/operator: fix IPv6 liveness probe address for operator (Backport PR #12333, Upstream PR #12223, @Rolinh) + * iptables: Remove '--nowildcard' from socket match (Backport PR #12333, Upstream PR #12248, @jrajahalme) + * Istio integration is updated to Istio release 1.5.6. (Backport PR #12333, Upstream PR #12214, @jrajahalme) + * Istio integration is updated to Istio release 1.5.7. (Backport PR #12357, Upstream PR #12353, @jrajahalme) + * make: fix LOCKDEBUG env variable reference for docker-plugin-image (Backport PR #12333, Upstream PR #12318, @Rolinh) + * option: Require native-routing-cidr only if IPv4 is enabled (Backport PR #12354, Upstream PR #12198, @brb) + * policy/api: Add reserved:health entity (Backport PR #12333, Upstream PR #12199, @pchaigno) + * stop Cilium from hanging on CNP or CCNP events from Kubernetes if running with 'k8s-event-handover=true' and 'kvstore=""' (Backport PR #12333, Upstream PR #12146, @aanm) + * The host proxy is updated to Envoy release 1.13.3 (Backport PR #12350, Upstream PR #12343, @jrajahalme) + * Valid CNP and CCNP 'matchLabel' values must be 63 characters or less and must be empty or begin and end with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. (Backport PR #12354, Upstream PR #12117, @aanm) +- 0001-option-mark-keep-bpf-templates-as-deprecated.patch, + 0002-make-remove-the-need-for-go-bindata.patch, + 0003-bpf-don-t-use-fixed-size-integer-types-from-stdint.h.patch, + 0004-helm-Allow-variables-for-compatibility-with-openSUSE.patch, + 0005-bpf-re-add-a-proper-types.h-mapper.patch, + 0006-build-Avoid-using-git-if-not-in-a-git-repo.patch, + 0007-option-rename-PolicyMapMaxEntries-to-PolicyMapEntrie.patch, + 0008-helm-allow-to-configure-bpf-nat-global-max-using-Hel.patch, + 0009-option-reduce-default-number-for-TCP-CT-and-NAT-tabl.patch, + 0010-daemon-add-option-to-dynamically-size-BPF-maps-based.patch: rebase against 1.7.6 + +------------------------------------------------------------------- Old: ---- cilium-1.7.5.obscpio New: ---- cilium-1.7.6.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cilium.spec ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.817072766 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.821072768 +0200 @@ -35,7 +35,7 @@ %endif Name: cilium -Version: 1.7.5 +Version: 1.7.6 Release: 0 Summary: Linux Native, HTTP Aware Networking and Security for Containers License: Apache-2.0 AND GPL-2.0-or-later @@ -243,6 +243,7 @@ ln -sf %{_sbindir}/service %{buildroot}%{_sbindir}/rc${service} done +sed -e 's-@LIBEXECDIR@-%{_libexecdir}-g' -i %{SOURCE2} install -D -m 0755 %{SOURCE2} %{buildroot}%{_sbindir}/cilium-cni-install install -D -m 0755 %{SOURCE3} %{buildroot}%{_sbindir}/cilium-cni-uninstall install -D -m 0755 contrib/packaging/docker/init-container.sh %{buildroot}/%{_bindir}/cilium-init ++++++ 0001-option-mark-keep-bpf-templates-as-deprecated.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.833072771 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.837072772 +0200 @@ -1,4 +1,4 @@ -From 467b6d5ad568809fc217dae3879890857bb3c32c Mon Sep 17 00:00:00 2001 +From 6b700699f521e201efb8ace69d95e076135878bb Mon Sep 17 00:00:00 2001 From: Tobias Klauser <tklau...@distanz.ch> Date: Wed, 12 Feb 2020 14:07:41 +0100 Subject: [PATCH 01/10] option: mark --keep-bpf-templates as deprecated @@ -16,7 +16,7 @@ 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/Documentation/cmdref/cilium-agent.md b/Documentation/cmdref/cilium-agent.md -index 1f51903dc..8925944db 100644 +index e8265f629..c3076b175 100644 --- a/Documentation/cmdref/cilium-agent.md +++ b/Documentation/cmdref/cilium-agent.md @@ -117,7 +117,6 @@ cilium-agent [flags] @@ -28,7 +28,7 @@ --kube-proxy-replacement string auto-enable available features for kube-proxy replacement ("probe"), or enable only selected features (will panic if any selected feature cannot be enabled) ("partial") or enable all features (will panic if any feature cannot be enabled) ("strict"), or completely disable it (ignores any selected feature) ("disabled") (default "partial") --kvstore string Key-value store type diff --git a/daemon/daemon_main.go b/daemon/daemon_main.go -index 89dd07b54..5acb48281 100644 +index 6028852bc..56f451334 100644 --- a/daemon/daemon_main.go +++ b/daemon/daemon_main.go @@ -461,6 +461,7 @@ func init() { @@ -40,7 +40,7 @@ flags.String(option.KVStore, "", "Key-value store type") option.BindEnv(option.KVStore) diff --git a/pkg/option/config.go b/pkg/option/config.go -index 630dc2fda..52e05a0ef 100644 +index 3173164c6..3643aadec 100644 --- a/pkg/option/config.go +++ b/pkg/option/config.go @@ -223,6 +223,8 @@ const ( @@ -53,5 +53,5 @@ // KVStore key-value store type -- -2.26.2 +2.27.0 ++++++ 0002-make-remove-the-need-for-go-bindata.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.845072774 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.849072775 +0200 @@ -1,4 +1,4 @@ -From d80e4fbf8c2b522700adc054f31bcbefc04e85e3 Mon Sep 17 00:00:00 2001 +From d3115d045b74d506b82f8e5a94f5c12de68a980f Mon Sep 17 00:00:00 2001 From: Tobias Klauser <tklau...@distanz.ch> Date: Thu, 13 Feb 2020 11:09:40 +0100 Subject: [PATCH 02/10] make: remove the need for go-bindata @@ -143,7 +143,7 @@ +----------------------------------------------------------------------------------+--------------------------+-------------------------------------------------------------------------------+ + `gomega <https://github.com/onsi/gomega>`_ | >= 1.2.0 | ``go get -u github.com/onsi/gomega`` | diff --git a/Makefile b/Makefile -index 829d78832..0977c664e 100644 +index 4db582c89..fca5de25a 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,4 @@ @@ -433,17 +433,17 @@ - $(GO_BINDATA) -o ./bindata.go $(BPF_FILES) diff --git a/daemon/bpf.sha b/daemon/bpf.sha deleted file mode 100644 -index a60ff9fbd..000000000 +index e4f35b406..000000000 --- a/daemon/bpf.sha +++ /dev/null @@ -1,2 +0,0 @@ --GO_BINDATA_SHA1SUM=b251f59546cc7ea8afebc6214c4c8c53b476f038 +-GO_BINDATA_SHA1SUM=4c9cc3d2d8462a47feff46ddfe344e0396d955b6 -BPF_FILES=../bpf/COPYING ../bpf/Makefile ../bpf/Makefile.bpf ../bpf/bpf_alignchecker.c ../bpf/bpf_features.h ../bpf/bpf_hostdev_ingress.c ../bpf/bpf_ipsec.c ../bpf/bpf_lxc.c ../bpf/bpf_netdev.c ../bpf/bpf_network.c ../bpf/bpf_overlay.c ../bpf/bpf_sock.c ../bpf/bpf_xdp.c ../bpf/cilium-map-migrate.c ../bpf/filter_config.h ../bpf/include/bpf/api.h ../bpf/include/elf/elf.h ../bpf/include/elf/gelf.h ../bpf/include/elf/libelf.h ../bpf/include/iproute2/bpf_elf.h ../bpf/include/linux/bpf.h ../bpf/include/linux/bpf_common.h ../bpf/include/linux/byteorder.h ../bpf/include/linux/byteorder/big_endian.h ../bpf/include/linux/byteorder/little_endian.h ../bpf/include/linux/icmp.h ../bpf/include/linux/icmpv6.h ../bpf/include/linux/if_arp.h ../bpf/include/linux/if_ether.h ../bpf/include/linux/if_packet.h ../bpf/include/linux/in.h ../bpf/include/linux/in6.h ../bpf/include/linux/ioctl.h ../bpf/include/linux/ip.h ../bpf/include/linux/ipv6.h ../bpf/include/linux/perf_event.h ../bpf/include/linux/swab.h ../bpf/include/linux/tcp.h ../bpf/include/linux/type_mapper.h ../bpf/include/linux/udp.h ../bpf/init.sh ../bpf/lib/arp.h ../bpf/lib/common.h ../bpf/lib/config.h ../bpf/lib/conntrack.h ../bpf/lib/conntrack_map.h ../bpf/lib/conntrack_test.h ../bpf/lib/csum.h ../bpf/lib/dbg.h ../bpf/lib/drop.h ../bpf/lib/encap.h ../bpf/lib/eps.h ../bpf/lib/eth.h ../bpf/lib/events.h ../bpf/lib/icmp6.h ../bpf/lib/identity.h ../bpf/lib/ipv4.h ../bpf/lib/ipv6.h ../bpf/lib/ipv6_test.h ../bpf/lib/l3.h ../bpf/lib/l4.h ../bpf/lib/lb.h ../bpf/lib/lxc.h ../bpf/lib/maps.h ../bpf/lib/metrics.h ../bpf/lib/nat.h ../bpf/lib/nat46.h ../bpf/lib/nodeport.h ../bpf/lib/policy.h ../bpf/lib/signal.h ../bpf/lib/tailcall.h ../bpf/lib/trace.h ../bpf/lib/utils.h ../bpf/lib/xdp.h ../bpf/lxc_config.h ../bpf/netdev_config.h ../bpf/node_config.h ../bpf/probes/raw_change_tail.t ../bpf/probes/raw_fib_lookup.t ../bpf/probes/raw_insn.h ../bpf/probes/raw_invalidate_hash.t ../bpf/probes/raw_lpm_map.t ../bpf/probes/raw_lru_map.t ../bpf/probes/raw_main.c ../bpf/probes/raw_max_insn.t ../bpf/probes/raw_sock_cookie.t ../bpf/run_probes.sh ../bpf/sockops/Makefile ../bpf/sockops/bpf_redir.c ../bpf/sockops/bpf_sockops.c ../bpf/sockops/bpf_sockops.h ../bpf/sockops/sockops_config.h diff --git a/daemon/daemon_main.go b/daemon/daemon_main.go -index 5acb48281..4b3a933a4 100644 +index 56f451334..8f64484aa 100644 --- a/daemon/daemon_main.go +++ b/daemon/daemon_main.go -@@ -743,9 +743,9 @@ func init() { +@@ -746,9 +746,9 @@ func init() { viper.BindPFlags(flags) } @@ -455,7 +455,7 @@ fileList := []string{} err := filepath.Walk(searchDir, func(path string, f os.FileInfo, err error) error { for _, pattern := range patterns { -@@ -918,20 +918,11 @@ func initEnv(cmd *cobra.Command) { +@@ -921,20 +921,11 @@ func initEnv(cmd *cobra.Command) { if err := os.MkdirAll(option.Config.LibDir, defaults.RuntimePathRights); err != nil { scopedLog.WithError(err).Fatal("Could not create library directory") } @@ -520,5 +520,5 @@ go get -u github.com/onsi/ginkgo/ginkgo go get -u github.com/onsi/gomega/... -- -2.26.2 +2.27.0 ++++++ 0003-bpf-don-t-use-fixed-size-integer-types-from-stdint.h.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.857072777 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.857072777 +0200 @@ -1,4 +1,4 @@ -From 7daa01fc7a23f83f6088b6eb43917cefa9944937 Mon Sep 17 00:00:00 2001 +From 8bed85809641de4d62cf80aa728ad5730205cbf6 Mon Sep 17 00:00:00 2001 From: Tobias Klauser <tklau...@distanz.ch> Date: Mon, 17 Feb 2020 11:58:32 +0100 Subject: [PATCH 03/10] bpf: don't use fixed size integer types from stdint.h @@ -120,12 +120,12 @@ +----------------------------------------------------------------------------------+--------------------------+-------------------------------------------------------------------------------+ | llvm | >= 3.9.1 | N/A (OS-specific) | diff --git a/bpf/Makefile.bpf b/bpf/Makefile.bpf -index e433094a7..371f60e7b 100644 +index 0e0b3e0d0..14e17a6eb 100644 --- a/bpf/Makefile.bpf +++ b/bpf/Makefile.bpf @@ -1,6 +1,6 @@ --FLAGS := -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc) -O2 -g -+FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc) -O2 -g +-FLAGS := -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc --all) -O2 -g ++FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc --all) -O2 -g -CLANG_FLAGS := ${FLAGS} -target bpf -emit-llvm +CLANG_FLAGS := ${FLAGS} -target bpf -emit-llvm @@ -182,7 +182,7 @@ #include "lib/dbg.h" diff --git a/bpf/bpf_lxc.c b/bpf/bpf_lxc.c -index 497edf48c..41a951c38 100644 +index 7b598915b..1f35c0091 100644 --- a/bpf/bpf_lxc.c +++ b/bpf/bpf_lxc.c @@ -22,9 +22,6 @@ @@ -676,10 +676,10 @@ struct udphdr { __be16 source; diff --git a/bpf/init.sh b/bpf/init.sh -index 8d18c4145..5036ca3f7 100755 +index 4ed5328c8..ae815c99e 100755 --- a/bpf/init.sh +++ b/bpf/init.sh -@@ -57,6 +57,8 @@ rm $RUNDIR/encap.state 2> /dev/null || true +@@ -58,6 +58,8 @@ rm $RUNDIR/encap.state 2> /dev/null || true # This directory was created by the daemon and contains the per container header file DIR="$PWD/globals" @@ -688,13 +688,13 @@ function setup_dev() { local -r NAME=$1 -@@ -270,6 +272,7 @@ function bpf_compile() +@@ -271,6 +273,7 @@ function bpf_compile() clang -O2 -g -target bpf -emit-llvm \ -Wno-address-of-packed-member -Wno-unknown-warning-option \ + -I/usr/include/${MACHINE}-linux-gnu \ -I. -I$DIR -I$LIB -I$LIB/include \ - -D__NR_CPUS__=$(nproc) \ + -D__NR_CPUS__=$NR_CPUS \ -DENABLE_ARP_RESPONDER \ diff --git a/bpf/lib/common.h b/bpf/lib/common.h index bde713507..ace0561dc 100644 @@ -1402,17 +1402,18 @@ } diff --git a/pkg/datapath/loader/compile.go b/pkg/datapath/loader/compile.go -index 7fab412ab..b244d46ad 100644 +index 449c9a4e7..dfc9b473f 100644 --- a/pkg/datapath/loader/compile.go +++ b/pkg/datapath/loader/compile.go -@@ -24,12 +24,14 @@ import ( +@@ -23,6 +23,7 @@ import ( + "io/ioutil" "os" "path" - "runtime" + "sync" + "github.com/cilium/cilium/common" "github.com/cilium/cilium/pkg/command/exec" - "github.com/cilium/cilium/pkg/logging/logfields" +@@ -30,6 +31,7 @@ import ( "github.com/cilium/cilium/pkg/option" "github.com/sirupsen/logrus" @@ -1467,14 +1468,14 @@ args = append(args, progCFlags(prog, dir)...) diff --git a/test/bpf/Makefile b/test/bpf/Makefile -index 063a9a019..49a85ce15 100644 +index 97fb5ea40..4919d32bc 100644 --- a/test/bpf/Makefile +++ b/test/bpf/Makefile @@ -1,6 +1,6 @@ include ../../Makefile.defs --FLAGS := -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc) -O2 -+FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc) -O2 +-FLAGS := -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc -all) -O2 ++FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc --all) -O2 BPF_CC_FLAGS := ${FLAGS} -target bpf -emit-llvm BPF_LLC_FLAGS := -march=bpf -mcpu=probe -filetype=obj @@ -1512,5 +1513,5 @@ #include "lib/conntrack_test.h" -- -2.26.2 +2.27.0 ++++++ 0004-helm-Allow-variables-for-compatibility-with-openSUSE.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.869072779 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.869072779 +0200 @@ -1,4 +1,4 @@ -From 7fc312d45653e8d3247ba8cc2ad6f50bab6c99c9 Mon Sep 17 00:00:00 2001 +From af0e3b27cbfd7795d9c76d74dee71aede88a4330 Mon Sep 17 00:00:00 2001 From: Michal Rostecki <mroste...@opensuse.org> Date: Mon, 24 Feb 2020 19:57:31 +0100 Subject: [PATCH 04/10] helm: Allow variables for compatibility with openSUSE @@ -116,5 +116,5 @@ # Specifies the maximum number of Pods that can be unavailable during the # update process. -- -2.26.2 +2.27.0 ++++++ 0005-bpf-re-add-a-proper-types.h-mapper.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.877072781 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.877072781 +0200 @@ -1,4 +1,4 @@ -From f590267aed3d373586e9ac8fff5bf63cc4bb10a1 Mon Sep 17 00:00:00 2001 +From cd966c7e198eb838cd1e838cd1c7b9eb764e7add Mon Sep 17 00:00:00 2001 From: Daniel Borkmann <dan...@iogearbox.net> Date: Thu, 19 Mar 2020 23:36:15 +0100 Subject: [PATCH 05/10] bpf: re-add a proper types.h mapper @@ -32,12 +32,12 @@ create mode 100644 bpf/include/linux/types.h diff --git a/bpf/Makefile.bpf b/bpf/Makefile.bpf -index 371f60e7b..63ef5fdf6 100644 +index 14e17a6eb..fee4b8322 100644 --- a/bpf/Makefile.bpf +++ b/bpf/Makefile.bpf @@ -1,4 +1,4 @@ --FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc) -O2 -g -+FLAGS := -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc) -O2 -g +-FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc --all) -O2 -g ++FLAGS := -I$(ROOT_DIR)/bpf/include -I$(ROOT_DIR)/bpf -D__NR_CPUS__=$(shell nproc --all) -O2 -g CLANG_FLAGS := ${FLAGS} -target bpf -emit-llvm # eBPF verifier enforces unaligned access checks where necessary, so don't @@ -96,10 +96,10 @@ + +#endif /* _LINUX_TYPES_H */ diff --git a/bpf/init.sh b/bpf/init.sh -index 5036ca3f7..8d18c4145 100755 +index ae815c99e..4ed5328c8 100755 --- a/bpf/init.sh +++ b/bpf/init.sh -@@ -57,8 +57,6 @@ rm $RUNDIR/encap.state 2> /dev/null || true +@@ -58,8 +58,6 @@ rm $RUNDIR/encap.state 2> /dev/null || true # This directory was created by the daemon and contains the per container header file DIR="$PWD/globals" @@ -108,26 +108,27 @@ function setup_dev() { local -r NAME=$1 -@@ -272,7 +270,6 @@ function bpf_compile() +@@ -273,7 +271,6 @@ function bpf_compile() clang -O2 -g -target bpf -emit-llvm \ -Wno-address-of-packed-member -Wno-unknown-warning-option \ - -I/usr/include/${MACHINE}-linux-gnu \ -I. -I$DIR -I$LIB -I$LIB/include \ - -D__NR_CPUS__=$(nproc) \ + -D__NR_CPUS__=$NR_CPUS \ -DENABLE_ARP_RESPONDER \ diff --git a/pkg/datapath/loader/compile.go b/pkg/datapath/loader/compile.go -index b244d46ad..5adc186ee 100644 +index dfc9b473f..df20ea261 100644 --- a/pkg/datapath/loader/compile.go +++ b/pkg/datapath/loader/compile.go -@@ -24,14 +24,12 @@ import ( +@@ -23,7 +23,6 @@ import ( + "io/ioutil" "os" "path" - "runtime" - "sync" + "github.com/cilium/cilium/common" "github.com/cilium/cilium/pkg/command/exec" - "github.com/cilium/cilium/pkg/logging/logfields" +@@ -31,7 +30,6 @@ import ( "github.com/cilium/cilium/pkg/option" "github.com/sirupsen/logrus" @@ -172,14 +173,14 @@ fmt.Sprintf("-I%s", dir.State), fmt.Sprintf("-I%s", dir.Library), diff --git a/test/bpf/Makefile b/test/bpf/Makefile -index 49a85ce15..c5e006499 100644 +index 4919d32bc..e4f0dfed2 100644 --- a/test/bpf/Makefile +++ b/test/bpf/Makefile @@ -1,8 +1,8 @@ include ../../Makefile.defs --FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc) -O2 -+FLAGS := -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc) -O2 +-FLAGS := -I/usr/include/$(shell uname -m)-linux-gnu -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc --all) -O2 ++FLAGS := -I../../bpf/ -I../../bpf/include -I. -D__NR_CPUS__=$(shell nproc --all) -O2 BPF_CC_FLAGS := ${FLAGS} -target bpf -emit-llvm -BPF_LLC_FLAGS := -march=bpf -mcpu=probe -filetype=obj +BPF_LLC_FLAGS := -march=bpf -mcpu=probe -filetype=obj @@ -187,5 +188,5 @@ LIB := $(shell find ../../bpf/ -name '*.h') -- -2.26.2 +2.27.0 ++++++ 0006-build-Avoid-using-git-if-not-in-a-git-repo.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.889072785 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.893072786 +0200 @@ -1,4 +1,4 @@ -From adcb5e534caacbd369ddac63c6fe2c4734bb7e99 Mon Sep 17 00:00:00 2001 +From 3235de2df4901d1d2f8c265f117ccb95e361b9c8 Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme <ja...@covalent.io> Date: Fri, 15 May 2020 17:33:01 -0700 Subject: [PATCH 06/10] build: Avoid using git if not in a git repo @@ -31,5 +31,5 @@ CILIUM_DATAPATH_SHA=$(shell cat $(BPF_FILES) | sha1sum | awk '{print $$1}') GOLDFLAGS += -X "github.com/cilium/cilium/pkg/datapath/loader.DatapathSHA=$(CILIUM_DATAPATH_SHA)" -- -2.26.2 +2.27.0 ++++++ 0007-option-rename-PolicyMapMaxEntries-to-PolicyMapEntrie.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.901072788 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.901072788 +0200 @@ -1,4 +1,4 @@ -From 3d5a59c46ea00133f81b8c22aaf2b5e764b83935 Mon Sep 17 00:00:00 2001 +From 1b18e321e27a0aea0d23069f71c2529304b4e35d Mon Sep 17 00:00:00 2001 From: Tobias Klauser <tklau...@distanz.ch> Date: Mon, 6 Apr 2020 20:13:13 +0200 Subject: [PATCH 07/10] option: rename PolicyMapMaxEntries to PolicyMapEntries @@ -27,7 +27,7 @@ if option.Config.DryMode == false { if err := bpf.ConfigureResourceLimits(); err != nil { diff --git a/pkg/option/config.go b/pkg/option/config.go -index 52e05a0ef..df24ad98b 100644 +index 3643aadec..f6c6fb473 100644 --- a/pkg/option/config.go +++ b/pkg/option/config.go @@ -1010,9 +1010,9 @@ type DaemonConfig struct { @@ -58,9 +58,9 @@ - c.PolicyMapMaxEntries, policyMapMax) + c.PolicyMapEntries, policyMapMax) } - // Validate that the KVStore Lease TTL value lies between a particular range. - if c.KVstoreLeaseTTL > defaults.KVstoreLeaseMaxTTL || c.KVstoreLeaseTTL < defaults.LockLeaseTTL { -@@ -1864,7 +1864,7 @@ func (c *DaemonConfig) Populate() { + if err := c.checkIPv4NativeRoutingCIDR(); err != nil { + return err +@@ -1868,7 +1868,7 @@ func (c *DaemonConfig) Populate() { c.NAT46Range = viper.GetString(NAT46Range) c.FlannelMasterDevice = viper.GetString(FlannelMasterDevice) c.FlannelUninstallOnExit = viper.GetBool(FlannelUninstallOnExit) @@ -70,5 +70,5 @@ c.PreAllocateMaps = viper.GetBool(PreAllocateMapsName) c.PrependIptablesChains = viper.GetBool(PrependIptablesChainsName) -- -2.26.2 +2.27.0 ++++++ 0008-helm-allow-to-configure-bpf-nat-global-max-using-Hel.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.909072790 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.913072790 +0200 @@ -1,4 +1,4 @@ -From 4f5f79074ddd974f48238540e586a4b7d9286c0b Mon Sep 17 00:00:00 2001 +From 5796b079cc4ff4ea685745c86dfd07135b7cadc6 Mon Sep 17 00:00:00 2001 From: Dirk Mueller <d...@dmllr.de> Date: Fri, 12 Jun 2020 19:20:09 +0200 Subject: [PATCH 08/10] helm: allow to configure bpf-nat-global-max using Helm @@ -17,7 +17,7 @@ 3 files changed, 11 insertions(+) diff --git a/install/kubernetes/cilium/charts/config/templates/configmap.yaml b/install/kubernetes/cilium/charts/config/templates/configmap.yaml -index adf1d0b37..0180b17d8 100644 +index ebc2a0158..7bcc40b23 100644 --- a/install/kubernetes/cilium/charts/config/templates/configmap.yaml +++ b/install/kubernetes/cilium/charts/config/templates/configmap.yaml @@ -136,6 +136,10 @@ data: @@ -32,10 +32,10 @@ # the expense of up-front memory allocation for the entries in the maps. The # default value below will minimize memory usage in the default installation; diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml -index bf011a6ee..9409f90e7 100644 +index 138375932..92e4d3c1b 100644 --- a/install/kubernetes/cilium/values.yaml +++ b/install/kubernetes/cilium/values.yaml -@@ -209,6 +209,9 @@ global: +@@ -213,6 +213,9 @@ global: # tracking table ctAnyMax: 262144 @@ -46,7 +46,7 @@ policyMapMax: 16384 diff --git a/install/kubernetes/quick-install.yaml b/install/kubernetes/quick-install.yaml -index 21e499268..cca20a800 100644 +index 4280c3377..bc106477b 100644 --- a/install/kubernetes/quick-install.yaml +++ b/install/kubernetes/quick-install.yaml @@ -79,6 +79,10 @@ data: @@ -61,5 +61,5 @@ # the expense of up-front memory allocation for the entries in the maps. The # default value below will minimize memory usage in the default installation; -- -2.26.2 +2.27.0 ++++++ 0009-option-reduce-default-number-for-TCP-CT-and-NAT-tabl.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.921072792 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.921072792 +0200 @@ -1,4 +1,4 @@ -From 4c362fd543c00aeb4257ac6bcc64fe102e05f31e Mon Sep 17 00:00:00 2001 +From ed37585d4d2342c318814d66bd83351843558c55 Mon Sep 17 00:00:00 2001 From: Tobias Klauser <tklau...@distanz.ch> Date: Fri, 21 Feb 2020 15:22:29 +0100 Subject: [PATCH 09/10] option: reduce default number for TCP CT and NAT table @@ -37,7 +37,7 @@ 6 files changed, 322 insertions(+), 7 deletions(-) diff --git a/Documentation/cmdref/cilium-agent.md b/Documentation/cmdref/cilium-agent.md -index 8925944db..e7e7a755a 100644 +index c3076b175..3e4f42107 100644 --- a/Documentation/cmdref/cilium-agent.md +++ b/Documentation/cmdref/cilium-agent.md @@ -25,14 +25,14 @@ cilium-agent [flags] @@ -384,7 +384,7 @@ 1.7 Upgrade Notes diff --git a/install/kubernetes/cilium/charts/config/templates/configmap.yaml b/install/kubernetes/cilium/charts/config/templates/configmap.yaml -index 0180b17d8..77fa80523 100644 +index 7bcc40b23..08ff88756 100644 --- a/install/kubernetes/cilium/charts/config/templates/configmap.yaml +++ b/install/kubernetes/cilium/charts/config/templates/configmap.yaml @@ -118,7 +118,7 @@ data: @@ -406,10 +406,10 @@ bpf-ct-global-any-max: "{{ .Values.global.bpf.ctAnyMax }}" diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml -index 9409f90e7..302e7b4c3 100644 +index 92e4d3c1b..bb8e151ea 100644 --- a/install/kubernetes/cilium/values.yaml +++ b/install/kubernetes/cilium/values.yaml -@@ -210,7 +210,7 @@ global: +@@ -214,7 +214,7 @@ global: ctAnyMax: 262144 # natMax is the maximum number of entries for the NAT table @@ -419,7 +419,7 @@ # policyMapMax is the maximum number of entries in endpoint policy map (per endpoint) policyMapMax: 16384 diff --git a/install/kubernetes/quick-install.yaml b/install/kubernetes/quick-install.yaml -index cca20a800..ab2f4a261 100644 +index bc106477b..5d6fdabf4 100644 --- a/install/kubernetes/quick-install.yaml +++ b/install/kubernetes/quick-install.yaml @@ -71,7 +71,7 @@ data: @@ -432,7 +432,7 @@ bpf-ct-global-any-max: "262144" diff --git a/pkg/option/config.go b/pkg/option/config.go -index df24ad98b..187a38286 100644 +index f6c6fb473..79e87a2fd 100644 --- a/pkg/option/config.go +++ b/pkg/option/config.go @@ -440,7 +440,7 @@ const ( @@ -445,5 +445,5 @@ CTMapEntriesGlobalTCPName = "bpf-ct-global-tcp-max" CTMapEntriesGlobalAnyName = "bpf-ct-global-any-max" -- -2.26.2 +2.27.0 ++++++ 0010-daemon-add-option-to-dynamically-size-BPF-maps-based.patch ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.933072795 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.933072795 +0200 @@ -1,4 +1,4 @@ -From a2587781735a609a82656f76a70dfc716b29e0f3 Mon Sep 17 00:00:00 2001 +From cff3e5709f84896f2985ec79d63bc1859b55a19a Mon Sep 17 00:00:00 2001 From: Tobias Klauser <tklau...@distanz.ch> Date: Thu, 9 Apr 2020 16:08:55 +0200 Subject: [PATCH 10/10] daemon: add option to dynamically size BPF maps based @@ -51,8 +51,8 @@ pkg/maps/nat/types.go | 6 + pkg/maps/policymap/policymap.go | 10 +- pkg/option/config.go | 142 +++++++++++++- - pkg/option/config_test.go | 177 ++++++++++++++++++ - 17 files changed, 405 insertions(+), 13 deletions(-) + pkg/option/config_test.go | 178 +++++++++++++++++- + 17 files changed, 405 insertions(+), 14 deletions(-) diff --git a/Documentation/architecture.rst b/Documentation/architecture.rst index d7a38ef1b..f836c3285 100644 @@ -95,7 +95,7 @@ ====================== diff --git a/Documentation/cmdref/cilium-agent.md b/Documentation/cmdref/cilium-agent.md -index e7e7a755a..65a06dc04 100644 +index 3e4f42107..fe720558b 100644 --- a/Documentation/cmdref/cilium-agent.md +++ b/Documentation/cmdref/cilium-agent.md @@ -32,6 +32,7 @@ cilium-agent [flags] @@ -136,7 +136,7 @@ ~~~~~~~~~~~~~~~~~~ diff --git a/Documentation/spelling_wordlist.txt b/Documentation/spelling_wordlist.txt -index 4c2618fbe..586be122c 100644 +index 621658892..b8201dabd 100644 --- a/Documentation/spelling_wordlist.txt +++ b/Documentation/spelling_wordlist.txt @@ -38,6 +38,7 @@ Fastabend @@ -148,7 +148,7 @@ Golang Gospodarek diff --git a/daemon/daemon_main.go b/daemon/daemon_main.go -index 4b3a933a4..127a2f897 100644 +index 8f64484aa..6e1a3beb2 100644 --- a/daemon/daemon_main.go +++ b/daemon/daemon_main.go @@ -51,7 +51,10 @@ import ( @@ -162,7 +162,7 @@ "github.com/cilium/cilium/pkg/metrics" monitorAPI "github.com/cilium/cilium/pkg/monitor/api" "github.com/cilium/cilium/pkg/node" -@@ -680,6 +683,9 @@ func init() { +@@ -683,6 +686,9 @@ func init() { flags.Int(option.PolicyMapEntriesName, defaults.PolicyMapEntries, "Maximum number of entries in endpoint policy map (per endpoint)") option.BindEnv(option.PolicyMapEntriesName) @@ -172,7 +172,7 @@ flags.String(option.CMDRef, "", "Path to cmdref output directory") flags.MarkHidden(option.CMDRef) option.BindEnv(option.CMDRef) -@@ -819,6 +825,13 @@ func initConfig() { +@@ -822,6 +828,13 @@ func initConfig() { } func initEnv(cmd *cobra.Command) { @@ -187,7 +187,7 @@ option.Config.Populate() diff --git a/install/kubernetes/cilium/charts/config/templates/configmap.yaml b/install/kubernetes/cilium/charts/config/templates/configmap.yaml -index 77fa80523..605c55d38 100644 +index 08ff88756..cd97b7e42 100644 --- a/install/kubernetes/cilium/charts/config/templates/configmap.yaml +++ b/install/kubernetes/cilium/charts/config/templates/configmap.yaml @@ -140,6 +140,10 @@ data: @@ -202,10 +202,10 @@ # the expense of up-front memory allocation for the entries in the maps. The # default value below will minimize memory usage in the default installation; diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml -index 302e7b4c3..09459dd9f 100644 +index bb8e151ea..f36c3f60f 100644 --- a/install/kubernetes/cilium/values.yaml +++ b/install/kubernetes/cilium/values.yaml -@@ -215,6 +215,13 @@ global: +@@ -219,6 +219,13 @@ global: # policyMapMax is the maximum number of entries in endpoint policy map (per endpoint) policyMapMax: 16384 @@ -220,7 +220,7 @@ monitorAggregation: medium diff --git a/install/kubernetes/quick-install.yaml b/install/kubernetes/quick-install.yaml -index ab2f4a261..47dd39b48 100644 +index 5d6fdabf4..ea5839b46 100644 --- a/install/kubernetes/quick-install.yaml +++ b/install/kubernetes/quick-install.yaml @@ -83,6 +83,10 @@ data: @@ -381,7 +381,7 @@ flags, 0, bpf.ConvertKeyValue, diff --git a/pkg/option/config.go b/pkg/option/config.go -index 187a38286..ea1a5b973 100644 +index 79e87a2fd..642650419 100644 --- a/pkg/option/config.go +++ b/pkg/option/config.go @@ -38,6 +38,7 @@ import ( @@ -433,7 +433,7 @@ } var ( -@@ -1764,9 +1786,6 @@ func (c *DaemonConfig) Populate() { +@@ -1768,9 +1790,6 @@ func (c *DaemonConfig) Populate() { c.AnnotateK8sNode = viper.GetBool(AnnotateK8sNode) c.AutoCreateCiliumNodeResource = viper.GetBool(AutoCreateCiliumNodeResource) c.BPFCompilationDebug = viper.GetBool(BPFCompileDebugName) @@ -443,7 +443,7 @@ c.BPFRoot = viper.GetString(BPFRoot) c.CertDirectory = viper.GetString(CertsDirectory) c.CGroupRoot = viper.GetString(CGroupRoot) -@@ -1864,7 +1883,6 @@ func (c *DaemonConfig) Populate() { +@@ -1868,7 +1887,6 @@ func (c *DaemonConfig) Populate() { c.NAT46Range = viper.GetString(NAT46Range) c.FlannelMasterDevice = viper.GetString(FlannelMasterDevice) c.FlannelUninstallOnExit = viper.GetBool(FlannelUninstallOnExit) @@ -451,7 +451,7 @@ c.PProf = viper.GetBool(PProf) c.PreAllocateMaps = viper.GetBool(PreAllocateMapsName) c.PrependIptablesChains = viper.GetBool(PrependIptablesChainsName) -@@ -1894,6 +1912,10 @@ func (c *DaemonConfig) Populate() { +@@ -1898,6 +1916,10 @@ func (c *DaemonConfig) Populate() { c.ipv4NativeRoutingCIDR = cidr.MustParseCIDR(nativeCIDR) } @@ -462,7 +462,7 @@ // toFQDNs options // When the poller is enabled, the default MinTTL is lowered. This is to // avoid caching large sets of identities generated by a poller (it runs -@@ -2101,6 +2123,118 @@ func (c *DaemonConfig) populateHostServicesProtos() error { +@@ -2122,6 +2144,118 @@ func (c *DaemonConfig) checkIPv4NativeRoutingCIDR() error { return nil } @@ -582,19 +582,20 @@ intParam := viper.GetInt(paramName) if intParam <= 0 { diff --git a/pkg/option/config_test.go b/pkg/option/config_test.go -index 46757710b..c0303ec1b 100644 +index 60bc9b1fa..4d50c9442 100644 --- a/pkg/option/config_test.go +++ b/pkg/option/config_test.go -@@ -24,6 +24,8 @@ import ( - "path/filepath" +@@ -25,7 +25,8 @@ import ( "testing" + "github.com/cilium/cilium/pkg/cidr" +- + "github.com/cilium/cilium/pkg/defaults" + "github.com/google/go-cmp/cmp" flag "github.com/spf13/pflag" "github.com/spf13/viper" . "gopkg.in/check.v1" -@@ -245,3 +247,178 @@ func (s *OptionSuite) TestEndpointStatusValues(c *C) { +@@ -317,3 +318,178 @@ func (s *OptionSuite) TestEndpointStatusValues(c *C) { c.Assert(ok, Equals, true) } } @@ -774,5 +775,5 @@ + } +} -- -2.26.2 +2.27.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:35.957072801 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:35.957072801 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> - <param name="revision">refs/tags/v1.7.5</param> + <param name="revision">refs/tags/v1.7.6</param> <param name="filename">cilium</param> <param name="changesgenerate">disable</param> </service> ++++++ cilium-1.7.5.obscpio -> cilium-1.7.6.obscpio ++++++ /work/SRC/openSUSE:Factory/cilium/cilium-1.7.5.obscpio /work/SRC/openSUSE:Factory/.cilium.new.3399/cilium-1.7.6.obscpio differ: char 27, line 1 ++++++ cilium-cni-install ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:36.005072812 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:36.009072814 +0200 @@ -1,4 +1,4 @@ #!/bin/sh cp -f /etc/cni/net.d/10-cilium-cni.conf /host/etc/cni/net.d/ -cp -f /usr/lib/cni/cilium-cni /host/opt/cni/bin/ +cp -f @LIBEXECDIR@/cni/cilium-cni /host/opt/cni/bin/ ++++++ cilium.obsinfo ++++++ --- /var/tmp/diff_new_pack.OztuFs/_old 2020-08-06 17:30:36.045072823 +0200 +++ /var/tmp/diff_new_pack.OztuFs/_new 2020-08-06 17:30:36.045072823 +0200 @@ -1,5 +1,5 @@ name: cilium -version: 1.7.5 -mtime: 1591966538 -commit: f524ca028289bc4f7a0cf5c8009eec6206bd05b4 +version: 1.7.6 +mtime: 1593726906 +commit: 4dce9cb9eaeef9f8cef71eda65bbd926d7bde7e9
