Skip to content

bpf: remove bpf_network.c and associated agent code#44284

Merged
ti-mo merged 2 commits intocilium:mainfrom
ti-mo:tb/remove-bpf-network
Feb 26, 2026
Merged

bpf: remove bpf_network.c and associated agent code#44284
ti-mo merged 2 commits intocilium:mainfrom
ti-mo:tb/remove-bpf-network

Conversation

@ti-mo
Copy link
Copy Markdown
Contributor

@ti-mo ti-mo commented Feb 10, 2026

Since commit a8c19d8 ("ipsec,config: require devices when IPsec is enabled"), shipped in Cilium 1.18, bpf_network.c quietly became dead code due to the introduction of a tautological condition:

if !lnc.EnableIPSec || option.Config.AreDevicesRequired(..., lnc.EnableIPSec) {
	return nil
}

AreDevicesRequired returns true if lnc.EnableIPSec is true, turning this into:

if !lnc.EnableIPSec || lnc.EnableIPSec { return nil }

This PR removes the Helm value, bpf_network.c, its tests, loader code and some cleanup routines.

Removed the `encryption.ipsec.interface` Helm value and its associated `bpf_network.c` program, which had been unused since at least Cilium 1.18.

@ti-mo ti-mo added the release-note/misc This PR makes changes that have no direct user impact. label Feb 10, 2026
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 10, 2026

/test

Copy link
Copy Markdown
Contributor

@smagnani96 smagnani96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First pass LGTM, left a comment.
Ping me again when you've looked at --encrypt-interface 💯

@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from f6d8428 to 625c3b6 Compare February 10, 2026 15:08
@ti-mo ti-mo added release-note/minor This PR changes functionality that users may find relevant to operating Cilium. and removed release-note/misc This PR makes changes that have no direct user impact. labels Feb 10, 2026
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 10, 2026

/test

@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from 625c3b6 to 444bf6b Compare February 11, 2026 10:36
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 11, 2026

/test

@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from 444bf6b to 26a7233 Compare February 11, 2026 11:11
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 11, 2026

/test

@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from 26a7233 to c0533a6 Compare February 11, 2026 12:13
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 11, 2026

/test

Copy link
Copy Markdown
Contributor

@smagnani96 smagnani96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, nothing else from my side 🙏🏼
You'll have to ping me again when undrafting this I guess (:github-intensifies:).

@ti-mo ti-mo marked this pull request as ready for review February 11, 2026 12:19
@ti-mo ti-mo requested review from a team as code owners February 11, 2026 12:19
@ti-mo ti-mo requested review from asauber and christarazi February 11, 2026 12:19
@ti-mo ti-mo enabled auto-merge February 11, 2026 22:13
@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from 5557bed to 79c80a7 Compare February 12, 2026 07:57
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 12, 2026

/test

@julianwiedmann julianwiedmann added area/loader Impacts the loading of BPF programs into the kernel. area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. feature/ipsec Relates to Cilium's IPsec feature labels Feb 16, 2026
@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from 79c80a7 to daff2d8 Compare February 18, 2026 12:27
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 18, 2026

/test

@smagnani96 smagnani96 removed the request for review from ldelossa February 18, 2026 13:54
Since commit a8c19d8 ("ipsec,config: require devices when IPsec is enabled"),
shipped in Cilium 1.18, bpf_network.c quietly became dead code due to the introduction
of a tautological condition:

```
if !lnc.EnableIPSec || option.Config.AreDevicesRequired(..., lnc.EnableIPSec) {
	return nil
}
```

AreDevicesRequired returns true if lnc.EnableIPSec is true, turning this into:

```
if !lnc.EnableIPSec || lnc.EnableIPSec { return nil }
```

This commit removed bpf_network.c, its tests, loader code and some cleanup routines.

Signed-off-by: Timo Beckers <timo@isovalent.com>
…face`

This has been defunct since Cilium 1.18 and ignored since the previous commit.

Signed-off-by: Timo Beckers <timo@isovalent.com>
@ti-mo ti-mo force-pushed the tb/remove-bpf-network branch from daff2d8 to 119b14d Compare February 26, 2026 11:06
@ti-mo
Copy link
Copy Markdown
Contributor Author

ti-mo commented Feb 26, 2026

/test

@ti-mo ti-mo added this pull request to the merge queue Feb 26, 2026
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Feb 26, 2026
@ti-mo ti-mo added this pull request to the merge queue Feb 26, 2026
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Feb 26, 2026
@ti-mo ti-mo added this pull request to the merge queue Feb 26, 2026
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Feb 26, 2026
@ti-mo ti-mo added this pull request to the merge queue Feb 26, 2026
Merged via the queue into cilium:main with commit 0aefff7 Feb 26, 2026
76 of 77 checks passed
@ti-mo ti-mo deleted the tb/remove-bpf-network branch February 26, 2026 16:01
@smagnani96 smagnani96 linked an issue Mar 11, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. area/loader Impacts the loading of BPF programs into the kernel. feature/ipsec Relates to Cilium's IPsec feature release-note/minor This PR changes functionality that users may find relevant to operating Cilium.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ipsec: phase out bpf_network