[41867] Part 3: Add subnet config watcher with stateDB and BPF map sync by anubhabMajumdar · Pull Request #43438 · cilium/cilium

anubhabMajumdar · 2025-12-18T23:28:23Z

Description

The motivation behind adding a new routing mode is discussed in this CFP .

Part-1 : #41868
Part-2 : #43631

This PR introduces subnet-to-identity mapping infrastructure in control plane to support hybrid
routing mode in Cilium. We introduce a StateDB for caching and reconciliation, with a
Kubernetes ConfigMap-driven configuration model. The stateDB data is sync'd to already introduce eBPF map.

Key Changes

This PR adds infrastructure for subnet-to-identity mapping in hybrid routing mode:

Add RoutingModeHybrid constant to routing mode options
Implement cilium_subnet_map under pkg/maps
- Support for both IPv4 and IPv6 address families
- SubnetMapKey/SubnetMapValue structures synced with bpf/lib/subnet.h
Add subnet-identities StateDB table to cache subnet topology
- Register reconciler to sync table entries to BPF map
- Integration with maps cell module
Implement subnet ConfigMap watcher in pkg/subnet
- Parse and validate subnet configuration from ConfigMap
- Automatic propagation of changes to StateDB
Add script commands for map dumping and debugging

Testing Done

Unit tests for BPF map key/value serialization and operations
E2e script-based tests validating full flow: ConfigMap → StateDB → BPF map
Verified subnet entry reconciliation and status tracking manually
Tested both IPv4 and IPv6 subnet configurations

$ PRIVILEGED_TESTS=true go test -v -exec "sudo -E" ./pkg/subnet
=== RUN   TestPrivilegedScript
=== RUN   TestPrivilegedScript/subnet.txtar
...
--- PASS: TestPrivilegedScript (0.00s)
    --- PASS: TestPrivilegedScript/subnet.txtar (0.05s)
PASS
ok      github.com/cilium/cilium/pkg/subnet     0.092s

Please ensure your pull request adheres to the following guidelines:

For first time contributors, read Submitting a pull request
All code is covered by unit and/or runtime tests where feasible.
All commits contain a well written commit description including a title,
description and a Fixes: #XXX line if the commit addresses a particular
GitHub issue.
If your commit description contains a Fixes: <commit-id> tag, then
please add the commit author[s] as reviewer[s] to this issue.
All commits are signed off. See the section Developer’s Certificate of Origin
Provide a title or release-note blurb suitable for the release notes.
Are you a user of Cilium? Please add yourself to the Users doc
Thanks for contributing!

Fixes: #41867

pkg/maps/subnet/cmds.go

anubhabMajumdar · 2025-12-19T18:09:37Z

Hey @gandro Thanks for your review on #41405 . I have incorporated all your feedback here. Would love to get your feedback on this PR. Thanks!

julianwiedmann · 2025-12-22T10:23:28Z

👋 mind addressing the test gaps in the datapath first, so that we can chase down bugs without needing the whole controlplane / e2e tests?

anubhabMajumdar · 2026-01-09T03:50:25Z

👋 mind addressing the test gaps in the datapath first, so that we can chase down bugs without needing the whole controlplane / e2e tests?

#43631 adds the bpf tests. Thanks!

gandro

Thanks! Overall looks okay to me, some minor things that I noticed in a first pass through.

pkg/maps/subnet/cell.go

pkg/subnet/cell.go

pkg/subnet/config.go

pkg/subnet/watcher.go

anubhabMajumdar · 2026-01-12T21:14:27Z

@gandro Thanks for the review; addressed your comments and left one open for discussion.

pkg/maps/subnet/cmds.go

pkg/maps/subnet/cell.go

pkg/maps/subnet/table.go

pkg/maps/subnet/cell.go

pkg/subnet/script_test.go

pkg/maps/subnet/cell.go

pkg/subnet/testdata/subnet.txtar

Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

anubhabMajumdar · 2026-01-28T01:46:28Z

/test

pkg/maps/subnet/subnet.go

pkg/option/config.go

pkg/maps/subnet/subnet_test.go

pkg/maps/subnet/subnet.go

pkg/maps/subnet/cmds.go

pkg/maps/subnet/cell.go

pkg/maps/subnet/subnet.go

…ting - Implement SubnetMapKey and SubnetMapValue for LPM trie lookups - Support both IPv4 and IPv6 address families - Add comprehensive unit tests for key/value operations - Add subnet/map-dump command for script testing and debugging - Map types synced with bpf/lib/subnet.h Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

- Add subnet-identities stateDB table to store CIDR->Identity mappings - Register reconciler to sync table entries to bpf map (cilium_subnet_map) - Introduce maps/subnet cell Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

- Introduce subnet-map config to supply underlying subnet configuration - Implement a watcher for above config that parse and adds the entries into subnet-identities stateDB - Provide a cell for pkg/subnet Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

Add script based tests to verify subnet configuration flows configmap to stateDB to bpf map. Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

anubhabMajumdar · 2026-01-29T00:09:33Z

/test

anubhabMajumdar · 2026-01-29T00:23:19Z

/ci-gateway-api

anubhabMajumdar · 2026-01-29T00:47:58Z

/ci-ginkgo

anubhabMajumdar · 2026-01-29T01:31:37Z

The ci-ginkgo test seems to fail due to different reason unrelated to this change.

smagnani96

LGTM, thanks 💯
Left one conversation open just to make sure we're not causing disruptions.
(In case, I expect we will catch it in subsequent PRs where we will test this in CI).

anubhabMajumdar requested review from a team as code owners December 18, 2025 23:28

anubhabMajumdar requested review from asauber and rastislavs December 18, 2025 23:28

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Dec 18, 2025

anubhabMajumdar requested review from pippolo84 and smagnani96 December 18, 2025 23:28

anubhabMajumdar marked this pull request as draft December 18, 2025 23:28

anubhabMajumdar force-pushed the topic/anmajumdar/hybrid-routing-subnet branch 2 times, most recently from 489d3dc to bdd65e2 Compare December 19, 2025 17:26

anubhabMajumdar commented Dec 19, 2025

View reviewed changes

pkg/maps/subnet/cmds.go Outdated Show resolved Hide resolved

anubhabMajumdar marked this pull request as ready for review December 19, 2025 18:07

anubhabMajumdar requested a review from a team as a code owner December 19, 2025 18:07

anubhabMajumdar changed the title ~~[41867] Part 2: Implement subnet-based identity routing for hybrid mode~~ [41867] Part 2: Add subnet config watcher with stateDB and BPF map sync Dec 19, 2025

julianwiedmann added the dont-merge/blocked Another PR must be merged before this one. label Dec 22, 2025

qmonnet added the release-note/major This PR introduces major new functionality to Cilium. label Jan 5, 2026

maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jan 5, 2026

qmonnet added release-note/minor This PR changes functionality that users may find relevant to operating Cilium. and removed release-note/major This PR introduces major new functionality to Cilium. labels Jan 5, 2026

joestringer added the dont-merge/wait-until-release Freeze window for current release is blocking non-bugfix PRs label Jan 9, 2026

anubhabMajumdar changed the title ~~[41867] Part 2: Add subnet config watcher with stateDB and BPF map sync~~ [41867] Part 3: Add subnet config watcher with stateDB and BPF map sync Jan 9, 2026

gandro reviewed Jan 12, 2026

View reviewed changes

pkg/maps/subnet/cell.go Outdated Show resolved Hide resolved

pkg/subnet/cell.go Outdated Show resolved Hide resolved

pkg/subnet/cell.go Outdated Show resolved Hide resolved

pkg/subnet/config.go Show resolved Hide resolved

pkg/subnet/watcher.go Outdated Show resolved Hide resolved

anubhabMajumdar mentioned this pull request Jan 12, 2026

Add fence to pkg/subnet.SubnetWatcher #43705

Open

anubhabMajumdar force-pushed the topic/anmajumdar/hybrid-routing-subnet branch from bdd65e2 to ce24658 Compare January 12, 2026 21:10

tklauser approved these changes Jan 27, 2026

View reviewed changes

joamaki requested changes Jan 27, 2026

View reviewed changes

joamaki reviewed Jan 27, 2026

View reviewed changes

pkg/maps/subnet/cell.go Outdated Show resolved Hide resolved

joamaki reviewed Jan 27, 2026

View reviewed changes

pkg/subnet/testdata/subnet.txtar Show resolved Hide resolved

option: Add hybrid routing mode constant

1713dd2

Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

anubhabMajumdar force-pushed the topic/anmajumdar/hybrid-routing-subnet branch 2 times, most recently from 2a3e61f to 5b0bc35 Compare January 28, 2026 01:45

anubhabMajumdar requested a review from joamaki January 28, 2026 01:45

asauber approved these changes Jan 28, 2026

View reviewed changes

julianwiedmann reviewed Jan 28, 2026

View reviewed changes

pkg/maps/subnet/subnet.go Outdated Show resolved Hide resolved

smagnani96 requested changes Jan 28, 2026

View reviewed changes

anubhabMajumdar added 4 commits January 28, 2026 17:59

pkg/subnet: Add e2e tests for subnet management

262bade

Add script based tests to verify subnet configuration flows configmap to stateDB to bpf map. Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

anubhabMajumdar force-pushed the topic/anmajumdar/hybrid-routing-subnet branch from 5b0bc35 to 262bade Compare January 29, 2026 00:05

anubhabMajumdar requested a review from smagnani96 January 29, 2026 00:23

smagnani96 approved these changes Jan 29, 2026

View reviewed changes

joamaki approved these changes Jan 30, 2026

View reviewed changes

smagnani96 added the area/agent Cilium agent related. label Jan 30, 2026

joamaki added this pull request to the merge queue Jan 30, 2026

Merged via the queue into cilium:main with commit e4021bf Jan 30, 2026
78 checks passed

anubhabMajumdar mentioned this pull request Feb 11, 2026

[41867] Part 4: Enable hybrid routing #44292

Draft

8 tasks

vanessachammas mentioned this pull request Mar 25, 2026

[41867] Hybrid routing part4 #45001

Open

8 tasks

Conversation

anubhabMajumdar commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Changes

Testing Done

Uh oh!

Uh oh!

anubhabMajumdar commented Dec 19, 2025

Uh oh!

julianwiedmann commented Dec 22, 2025

Uh oh!

anubhabMajumdar commented Jan 9, 2026

Uh oh!

gandro left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Jan 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Jan 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Jan 29, 2026

Uh oh!

anubhabMajumdar commented Jan 29, 2026

Uh oh!

anubhabMajumdar commented Jan 29, 2026

Uh oh!

anubhabMajumdar commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smagnani96 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

anubhabMajumdar commented Dec 18, 2025 •

edited

Loading

anubhabMajumdar commented Jan 29, 2026 •

edited

Loading