Skip to content

Commit 39346b8

Browse files
l1b0kl1b0k
committed
update policy image
backport: 04cc3fb 927d6ab Signed-off-by: l1b0k <[email protected]>
1 parent 325d07e commit 39346b8

File tree

4 files changed

+267
-106
lines changed

4 files changed

+267
-106
lines changed

Diff for: ‎Dockerfile

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
1-
ARG TERWAY_POLICY_IMAGE=registry-cn-zhangjiakou.ack.aliyuncs.com/acs/terway:policy-75c98940@sha256:6dbdffee0cdc5c29239d487b4e567046d7dd23f61d67dbbbce1a2e5db9b210dc
1+
ARG TERWAY_POLICY_IMAGE=registry-cn-zhangjiakou.ack.aliyuncs.com/acs/terway:policy-927d6ab6@sha256:dbcc2cef1164b7ce0de7700cefbdece7ca0281d84e5db91ce96488f1a2c00ed7
22
ARG UBUNTU_IMAGE=registry.cn-hangzhou.aliyuncs.com/acs/ubuntu:22.04-update
33
ARG CILIUM_LLVM_IMAGE=quay.io/cilium/cilium-llvm:547db7ec9a750b8f888a506709adb41f135b952e@sha256:4d6fa0aede3556c5fb5a9c71bc6b9585475ac9b1064f516d4c45c8fb691c9d9e
44
ARG CILIUM_BPFTOOL_IMAGE=quay.io/cilium/cilium-bpftool:78448c1a37ff2b790d5e25c3d8b8ec3e96e6405f@sha256:99a9453a921a8de99899ef82e0822f0c03f65d97005c064e231c06247ad8597d
55
ARG CILIUM_IPROUTE2_IMAGE=quay.io/cilium/cilium-iproute2:3570d58349efb2d6b0342369a836998c93afd291@sha256:1abcd7a5d2117190ab2690a163ee9cd135bc9e4cf8a4df662a8f993044c79342
66
ARG CILIUM_IPTABLES_IMAGE=quay.io/cilium/iptables-20.04:e6f83206c57e606282056903ffd3aab0183bdaed@sha256:7ce0de449d356a5259021dc13f2b00a8bddfbea57a1c91ff8f146d455cace9e5
77

8-
FROM --platform=$TARGETPLATFORM ${TERWAY_POLICY_IMAGE} as policy-dist
9-
FROM --platform=$TARGETPLATFORM ${CILIUM_LLVM_IMAGE} as llvm-dist
10-
FROM --platform=$TARGETPLATFORM ${CILIUM_BPFTOOL_IMAGE} as bpftool-dist
11-
FROM --platform=$TARGETPLATFORM ${CILIUM_IPROUTE2_IMAGE} as iproute2-dist
12-
FROM --platform=$TARGETPLATFORM ${CILIUM_IPTABLES_IMAGE} as iptables-dist
8+
FROM --platform=$TARGETPLATFORM ${TERWAY_POLICY_IMAGE} AS policy-dist
9+
FROM --platform=$TARGETPLATFORM ${CILIUM_LLVM_IMAGE} AS llvm-dist
10+
FROM --platform=$TARGETPLATFORM ${CILIUM_BPFTOOL_IMAGE} AS bpftool-dist
11+
FROM --platform=$TARGETPLATFORM ${CILIUM_IPROUTE2_IMAGE} AS iproute2-dist
12+
FROM --platform=$TARGETPLATFORM ${CILIUM_IPTABLES_IMAGE} AS iptables-dist
1313

14-
FROM --platform=$BUILDPLATFORM golang:1.21.3 as builder
14+
FROM --platform=$BUILDPLATFORM golang:1.23.2 AS builder
1515
ARG GOPROXY
1616
ARG TARGETOS
1717
ARG TARGETARCH
18-
ENV GOPROXY $GOPROXY
18+
ENV GOPROXY=$GOPROXY
1919
WORKDIR /go/src/github.com/AliyunContainerService/terway/
2020
COPY go.sum go.mod ./
2121
RUN go mod download

Diff for: ‎policy/cilium/0032-fix-disable-per-package-lb.patch

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: l1b0k <[email protected]>
3+
Date: Sat, 12 Oct 2024 09:33:24 +0800
4+
Subject: fix disable per-package lb
5+
6+
Signed-off-by: l1b0k <[email protected]>
7+
---
8+
bpf/bpf_lxc.c | 5 ++---
9+
daemon/cmd/daemon_main.go | 3 +++
10+
pkg/datapath/linux/config/config.go | 5 +++++
11+
pkg/option/config.go | 6 ++++++
12+
4 files changed, 16 insertions(+), 3 deletions(-)
13+
14+
diff --git a/bpf/bpf_lxc.c b/bpf/bpf_lxc.c
15+
index 2773e2c276..7e424204e2 100644
16+
--- a/bpf/bpf_lxc.c
17+
+++ b/bpf/bpf_lxc.c
18+
@@ -58,9 +58,9 @@
19+
* Most services with L7 LB flag can not be redirected to their proxy port
20+
* in bpf_sock, so we must check for those via per packet LB as well.
21+
*/
22+
-#if !defined(ENABLE_SOCKET_LB_FULL) || \
23+
+#if (!defined(ENABLE_SOCKET_LB_FULL) || \
24+
defined(ENABLE_SOCKET_LB_HOST_ONLY) || \
25+
- defined(ENABLE_L7_LB)
26+
+ defined(ENABLE_L7_LB) ) && !defined(DISABLE_PER_PACKET_LB)
27+
# define ENABLE_PER_PACKET_LB 1
28+
#endif
29+
30+
@@ -1247,7 +1247,6 @@ static __always_inline int __tail_handle_ipv4(struct __ctx_buff *ctx)
31+
32+
if (unlikely(!is_valid_lxc_src_ipv4(ip4)))
33+
return DROP_INVALID_SIP;
34+
-
35+
#ifdef ENABLE_PER_PACKET_LB
36+
{
37+
struct ipv4_ct_tuple tuple = {};
38+
diff --git a/daemon/cmd/daemon_main.go b/daemon/cmd/daemon_main.go
39+
index de2ad4900b..8b495d972f 100644
40+
--- a/daemon/cmd/daemon_main.go
41+
+++ b/daemon/cmd/daemon_main.go
42+
@@ -1147,6 +1147,9 @@ func initializeFlags() {
43+
flags.MarkHidden(option.EnableStaleCiliumEndpointCleanup)
44+
option.BindEnv(option.EnableStaleCiliumEndpointCleanup)
45+
46+
+ flags.Bool(option.DisablePerPacketLB, false, "Disable svc func.")
47+
+ option.BindEnv(option.DisablePerPacketLB)
48+
+
49+
viper.BindPFlags(flags)
50+
}
51+
52+
diff --git a/pkg/datapath/linux/config/config.go b/pkg/datapath/linux/config/config.go
53+
index 060328adf9..4201e878fb 100644
54+
--- a/pkg/datapath/linux/config/config.go
55+
+++ b/pkg/datapath/linux/config/config.go
56+
@@ -98,6 +98,11 @@ func (h *HeaderfileWriter) WriteNodeConfig(w io.Writer, cfg *datapath.LocalNodeC
57+
58+
cDefinesMap["KERNEL_HZ"] = fmt.Sprintf("%d", option.Config.KernelHz)
59+
60+
+ if option.Config.DisablePerPacketLB {
61+
+ log.Infof("Disabling per-packet LB policy")
62+
+ cDefinesMap["DISABLE_PER_PACKET_LB"] = "1"
63+
+ }
64+
+
65+
if option.Config.EnableIPv6 {
66+
extraMacrosMap["ROUTER_IP"] = routerIP.String()
67+
fw.WriteString(defineIPv6("ROUTER_IP", routerIP))
68+
diff --git a/pkg/option/config.go b/pkg/option/config.go
69+
index d4d9643f4e..80b5eb2c7c 100644
70+
--- a/pkg/option/config.go
71+
+++ b/pkg/option/config.go
72+
@@ -1104,6 +1104,8 @@ const (
73+
// EnableStaleCiliumEndpointCleanup sets whether Cilium should perform cleanup of
74+
// stale CiliumEndpoints during init.
75+
EnableStaleCiliumEndpointCleanup = "enable-stale-cilium-endpoint-cleanup"
76+
+
77+
+ DisablePerPacketLB = "disable-per-package-lb"
78+
)
79+
80+
// Default string arguments
81+
@@ -2262,6 +2264,8 @@ type DaemonConfig struct {
82+
// This will attempt to remove local CiliumEndpoints that are not managed by Cilium
83+
// following Endpoint restoration.
84+
EnableStaleCiliumEndpointCleanup bool
85+
+
86+
+ DisablePerPacketLB bool
87+
}
88+
89+
var (
90+
@@ -3257,6 +3261,8 @@ func (c *DaemonConfig) Populate() {
91+
c.EnableK8sTerminatingEndpoint = viper.GetBool(EnableK8sTerminatingEndpoint)
92+
c.EnableStaleCiliumEndpointCleanup = viper.GetBool(EnableStaleCiliumEndpointCleanup)
93+
94+
+ c.DisablePerPacketLB = viper.GetBool(DisablePerPacketLB)
95+
+
96+
// Disable Envoy version check if L7 proxy is disabled.
97+
c.DisableEnvoyVersionCheck = viper.GetBool(DisableEnvoyVersionCheck)
98+
if !c.EnableL7Proxy {
99+
--
100+
2.46.0
101+

Diff for: ‎policy/cilium/0033-logging.patch

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: l1b0k <[email protected]>
3+
Date: Mon, 14 Oct 2024 16:33:42 +0800
4+
Subject: logging
5+
6+
Signed-off-by: l1b0k <[email protected]>
7+
---
8+
pkg/maps/ctmap/ctmap.go | 19 +++++++++++++------
9+
1 file changed, 13 insertions(+), 6 deletions(-)
10+
11+
diff --git a/pkg/maps/ctmap/ctmap.go b/pkg/maps/ctmap/ctmap.go
12+
index 868871811b..052cab28e9 100644
13+
--- a/pkg/maps/ctmap/ctmap.go
14+
+++ b/pkg/maps/ctmap/ctmap.go
15+
@@ -496,6 +496,13 @@ func doGC4(m *Map, filter *GCFilter) gcStats {
16+
globalDeleteLock[m.mapType].Lock()
17+
stats.dumpError = m.DumpReliablyWithCallback(filterCallback, stats.DumpStats)
18+
globalDeleteLock[m.mapType].Unlock()
19+
+
20+
+ log.Infof("gc map %s id %d max %d deleted %d alived %d", m.Name(), m.InnerID, m.MaxEntries, stats.deleted, stats.aliveEntries)
21+
+ cur := stats.aliveEntries + stats.deleted
22+
+ if float64(cur)/float64(m.MaxEntries) >= 0.9 {
23+
+ log.Infof("ConntrackFull table %s current %d maxEntries %d", m.Name(), cur, m.MaxEntries)
24+
+ }
25+
+
26+
return stats
27+
}
28+
29+
@@ -566,13 +573,13 @@ func GC(m *Map, filter *GCFilter) int {
30+
// The consumer of the buffer invokes the function.
31+
//
32+
// The SNAT is being used for the following cases:
33+
-// 1. By NodePort BPF on an intermediate node before fwd'ing request from outside
34+
+// 1. By NodePort BPF on an intermediate node before fwd'ing request from outside
35+
// to a destination node.
36+
-// 2. A packet from local endpoint sent to outside (BPF-masq).
37+
-// 3. A packet from a host local application (i.e. running in the host netns)
38+
-// This is needed to prevent SNAT from hijacking such connections.
39+
-// 4. By DSR on a backend node to SNAT responses with service IP+port before
40+
-// sending to a client.
41+
+// 2. A packet from local endpoint sent to outside (BPF-masq).
42+
+// 3. A packet from a host local application (i.e. running in the host netns)
43+
+// This is needed to prevent SNAT from hijacking such connections.
44+
+// 4. By DSR on a backend node to SNAT responses with service IP+port before
45+
+// sending to a client.
46+
//
47+
// In the case of 1-3, we always create a CT_EGRESS CT entry. This allows the
48+
// CT GC to remove corresponding SNAT entries. In the case of 4, will create
49+
--
50+
2.47.0
51+

0 commit comments

Comments
 (0)