Fix IPsec support for --devices#31345
Merged
pchaigno merged 4 commits intocilium:mainfrom Mar 25, 2024
Merged
Conversation
4c2d590 to
3035a72
Compare
tklauser
approved these changes
Mar 15, 2024
jschwinger233
approved these changes
Mar 15, 2024
Member
jschwinger233
left a comment
There was a problem hiding this comment.
Just a small discrepancy between commit message and code.
Those helper functions to retrieve the local IPs are all IPsec specific so let's move them to the ipsec.go file. No functional changes in this commit. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
This commit extends getDefaultEncryptionInterface to also handle tunneling mode. That change allows us to start using getDefaultEncryptionInterface everywhere we need to retrieve the default IPsec interface. The unit test for IPsec in subnet encryption mode (ENI and Azure IPAM modes) must be updated. Subnet encryption is only ever possible in native routing mode. If we were doing subnet encryption with tunneling, it would cause undefined behaviors (in the test would fail :)). Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
The agent supported attaching the IPsec decryption logic to interfaces given via --devices. In that case, this logic was contained in bpf_host instead of bpf_network. This support is partially covered in ginkgo end-to-end tests. That support is however broken, as there doesn't seem to be anything preventing bpf_network from being reloaded in place of bpf_host on the same interfaces. This commit fixes it by implementing proper support for --devices in IPsec. If no devices flag is given then we fallback to using the encrypt-interface flag. That should allow us to deprecate encrypt-interface at a latter time. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
3035a72 to
029615c
Compare
Member
Author
|
/test |
jschwinger233
approved these changes
Mar 15, 2024
viktor-kurchenko
approved these changes
Mar 18, 2024
rgo3
approved these changes
Mar 25, 2024
Contributor
rgo3
left a comment
There was a problem hiding this comment.
Overall LGTM, just a question for clarification.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first two commits are refactoring commits. The third fixes the support for
--devicesin IPsec. Fourth commit covers this in end-to-end IPsec tests.