[ upstream commit 0baeaa1 ]

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 2db8829 ]

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 4355df5 ]

Mention:
- Doesn't support L7 policies.
- Applies only to host namespace.
- Only for CCNPs.
- Example

Signed-off-by: Paul Chaignon <paul@cilium.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 0e535cb ]

This commit updates the getting started guide for kata containers in the
following ways:

- Remove all custom instructions that were likely copied over from
  external sources, namely the official Kata Containers, CRI-O and
  containerd guides. These turned out to be outdated for the most part.
  Instead, this guide now points the reader to the official guides from
  the Kata Containers documentation to setup Kata Containers and a
  Kubernetes cluster.
- By removing custom instructions and linking to the official Kata
  Containers documentation, this guide is now also more generic in that
  it should work for any platform that supports the Kata Containers
  runtime instead of being specific to Google Compute Engine (GCE).
- This guide now being generic, rename it, including the file name, to
  just kata instead of kata-gce.
- Include `k8s-install-download-release.rst` instead of duplicating the
  instructions.
- Add a note that this guide has only been validated using instructions
  for GCE.

Signed-off-by: Robin Hahling <robin.hahling@gw-computing.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit ac158be ]

Rework a couple of the existing instances to reuse this.

Signed-off-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 5d00f6a ]

Based partially on prior wording from Quentin Monnet.

Signed-off-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit ff4882a ]

All test packages need to have a hook for check.v1

This commit adds the missing checks on those unit tests.

Signed-off-by: André Martins <andre@cilium.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 62e4558 ]

Noticed in local testing that an Istio sidecar-injector label can
prevent PODs being deployed in the default namespace if left behind by
a failed Istio test.

Delete also all other resources left into the default namespace.

Delete cilium-monitoring and cilium namespaces to leave the cluster in
a more predictable condition.

Finally, delete all CRDs.

Move the cleaning to the renamed `gke/clean-cluster.sh` so that it can
be reused from the command line in local testing.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 28eb07b ]

This commit extends "cilium status" to show which devices can run
the BPF masquerading program. E.g.:

    $ cilium status | grep Masquerading
    Masquerading:           BPF   [eth0, eth1]

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit ec20119 ]

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit ec89f62 ]

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 202b199 ]

The helper is used to determine the dst CIDR for SNAT exclusion.

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 4197021 ]

This commits extends "cilium status" to show dst cidr of SNAT exclusion.
E.g.:

    $ cilium status | grep Masquerading
    Masquerading:           BPF   [eth0, eth1]  10.0.0.0/16

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 2f04afd ]

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

[ upstream commit 5462ced ]

Otherwise, cilium-agent will panic when --enable-ipv6=true with the
following:

    panic: runtime error: invalid memory address or nil pointer dereference
    [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x1b17ec7]

    [...]
    /go/src/github.com/cilium/cilium/pkg/datapath/linux/config/config.go:344 +0x31d7

Fixes: a562b74 ("bpf: Check native-routing-cidr in BPF masquerade")
Reported-by: Robin Hahling <robin.hahling@gw-computing.net>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>