feat(helm): update chart cilium ( 1.18.5 ➔ 1.19.3 )#3135
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
feat(helm): update chart cilium ( 1.18.5 ➔ 1.19.3 )#3135renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
qgr1-cluster-0 - helmrelease--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config
@@ -54,12 +54,13 @@
cluster-name: qgr1-cluster-0
cluster-id: '1'
routing-mode: native
tunnel-protocol: vxlan
tunnel-source-port-range: 0-0
service-no-backend-response: reject
+ policy-deny-response: none
enable-l7-proxy: 'true'
enable-ipv4-masquerade: 'true'
enable-ipv4-big-tcp: 'true'
enable-ipv6-big-tcp: 'false'
enable-ipv6-masquerade: 'true'
enable-tcx: 'true'
@@ -76,23 +77,24 @@
enable-bbr-hostns-only: 'false'
enable-local-redirect-policy: 'true'
ipv4-native-routing-cidr: 10.36.0.0/16
devices: en+
kube-proxy-replacement: 'true'
kube-proxy-replacement-healthz-bind-address: 0.0.0.0:10256
+ enable-no-service-endpoints-routable: 'true'
bpf-lb-sock: 'true'
bpf-lb-sock-hostns-only: 'true'
nodeport-addresses: ''
enable-health-check-nodeport: 'true'
enable-health-check-loadbalancer-ip: 'false'
node-port-bind-protection: 'true'
enable-auto-protect-node-port-range: 'true'
bpf-lb-mode: dsr
bpf-lb-algorithm: maglev
bpf-lb-acceleration: disabled
- enable-svc-source-range-check: 'true'
+ enable-service-topology: 'false'
enable-l2-neigh-discovery: 'false'
k8s-require-ipv4-pod-cidr: 'false'
k8s-require-ipv6-pod-cidr: 'false'
enable-endpoint-routes: 'true'
enable-k8s-networkpolicy: 'true'
enable-endpoint-lockdown-on-policy-overflow: 'false'
@@ -120,54 +122,62 @@
bgp-secrets-namespace: kube-system
enable-bgp-control-plane-status-report: 'true'
bgp-router-id-allocation-mode: default
bgp-router-id-allocation-ip-pool: ''
enable-bgp-legacy-origin-attribute: 'false'
enable-pmtu-discovery: 'true'
+ packetization-layer-pmtud-mode: blackhole
procfs: /host/proc
bpf-root: /sys/fs/bpf
cgroup-root: /run/cilium/cgroupv2
identity-management-mode: agent
enable-sctp: 'false'
remove-cilium-node-taints: 'true'
set-cilium-node-taints: 'true'
set-cilium-is-up-condition: 'true'
- unmanaged-pod-watcher-interval: '15'
+ unmanaged-pod-watcher-interval: 15s
dnsproxy-enable-transparent-mode: 'true'
dnsproxy-socket-linger-timeout: '10'
tofqdns-dns-reject-response-code: refused
tofqdns-enable-dns-compression: 'true'
tofqdns-endpoint-max-ip-per-hostname: '1000'
tofqdns-idle-connection-grace-period: 0s
tofqdns-max-deferred-connection-deletes: '10000'
tofqdns-proxy-response-max-delay: 100ms
tofqdns-preallocate-identities: 'true'
agent-not-ready-taint-key: node.cilium.io/agent-not-ready
- mesh-auth-enabled: 'true'
+ mesh-auth-enabled: 'false'
mesh-auth-queue-size: '1024'
mesh-auth-rotated-identities-queue-size: '1024'
mesh-auth-gc-interval: 5m0s
proxy-xff-num-trusted-hops-ingress: '0'
proxy-xff-num-trusted-hops-egress: '0'
proxy-connect-timeout: '2'
proxy-initial-fetch-timeout: '30'
+ proxy-max-active-downstream-connections: '50000'
proxy-max-requests-per-connection: '0'
proxy-max-connection-duration-seconds: '0'
proxy-idle-timeout-seconds: '60'
proxy-max-concurrent-retries: '128'
+ proxy-use-original-source-address: 'true'
+ proxy-cluster-max-connections: '1024'
+ proxy-cluster-max-requests: '1024'
http-retry-count: '3'
http-stream-idle-timeout: '300'
external-envoy-proxy: 'true'
envoy-base-id: '0'
envoy-access-log-buffer-size: '4096'
envoy-keep-cap-netbindservice: 'false'
max-connected-clusters: '255'
+ clustermesh-cache-ttl: 0s
clustermesh-enable-endpoint-sync: 'false'
clustermesh-enable-mcs-api: 'false'
- policy-default-local-cluster: 'false'
+ clustermesh-mcs-api-install-crds: 'true'
+ policy-default-local-cluster: 'true'
nat-map-stats-entries: '32'
nat-map-stats-interval: 30s
- enable-internal-traffic-policy: 'true'
enable-lb-ipam: 'true'
enable-non-default-deny-policies: 'true'
enable-source-ip-verification: 'true'
+ enable-dynamic-config: 'true'
+ enable-drift-checker: 'true'
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-envoy-config
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-envoy-config
@@ -3,8 +3,8 @@
kind: ConfigMap
metadata:
name: cilium-envoy-config
namespace: kube-system
data:
bootstrap-config.json: |
- {"admin":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}}
[Diff truncated by flux-local]
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium
+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium
@@ -43,13 +43,12 @@
- watch
- get
- apiGroups:
- cilium.io
resources:
- ciliumloadbalancerippools
- - ciliumbgppeeringpolicies
- ciliumbgpnodeconfigs
- ciliumbgpadvertisements
- ciliumbgppeerconfigs
- ciliumclusterwideenvoyconfigs
- ciliumclusterwidenetworkpolicies
- ciliumegressgatewaypolicies
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium-operator
+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium-operator
@@ -72,12 +72,24 @@
- watch
- create
- update
- delete
- patch
- apiGroups:
+ - discovery.k8s.io
+ resources:
+ - endpointslices
+ verbs:
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - delete
+ - patch
+- apiGroups:
- cilium.io
resources:
- ciliumnetworkpolicies
- ciliumclusterwidenetworkpolicies
verbs:
- create
@@ -164,13 +176,12 @@
resources:
- customresourcedefinitions
verbs:
- update
resourceNames:
- ciliumloadbalancerippools.cilium.io
- - ciliumbgppeeringpolicies.cilium.io
- ciliumbgpclusterconfigs.cilium.io
- ciliumbgppeerconfigs.cilium.io
- ciliumbgpadvertisements.cilium.io
- ciliumbgpnodeconfigs.cilium.io
- ciliumbgpnodeconfigoverrides.cilium.io
- ciliumclusterwideenvoyconfigs.cilium.io
@@ -190,13 +201,12 @@
- ciliumgatewayclassconfigs.cilium.io
- apiGroups:
- cilium.io
resources:
- ciliumloadbalancerippools
- ciliumpodippools
- - ciliumbgppeeringpolicies
- ciliumbgpclusterconfigs
- ciliumbgpnodeconfigoverrides
- ciliumbgppeerconfigs
verbs:
- get
- list
@@ -272,7 +282,13 @@
resources:
- serviceimports
verbs:
- get
- list
- watch
+- apiGroups:
+ - cilium.io
+ resources:
+ - ciliumendpointslices
+ verbs:
+ - deletecollection
--- HelmRelease: kube-system/cilium Service: kube-system/cilium-envoy
+++ HelmRelease: kube-system/cilium Service: kube-system/cilium-envoy
@@ -18,8 +18,8 @@
selector:
k8s-app: cilium-envoy
ports:
- name: envoy-metrics
port: 9964
protocol: TCP
- targetPort: envoy-metrics
+ targetPort: 9964
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium
+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium
@@ -16,13 +16,13 @@
rollingUpdate:
maxUnavailable: 2
type: RollingUpdate
template:
metadata:
annotations:
- cilium.io/cilium-configmap-checksum: 0aaec65d6662e6a0823e80c87180cdd90a34513c222faec286e03d6e170bf382
+ cilium.io/cilium-configmap-checksum: 832590e13e507f2e137adfb34f6a3a60a5ffa708280b5ea31a4d4d614415ee14
kubectl.kubernetes.io/default-container: cilium-agent
labels:
k8s-app: cilium
app.kubernetes.io/name: cilium-agent
app.kubernetes.io/part-of: cilium
spec:
@@ -30,36 +30,36 @@
appArmorProfile:
type: Unconfined
seccompProfile:
type: Unconfined
containers:
- name: cilium-agent
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
command:
- cilium-agent
args:
- --config-dir=/tmp/cilium/config-map
startupProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9879
+ port: health
scheme: HTTP
httpHeaders:
- name: brief
value: 'true'
failureThreshold: 300
periodSeconds: 2
successThreshold: 1
initialDelaySeconds: 5
livenessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9879
+ port: health
scheme: HTTP
httpHeaders:
- name: brief
value: 'true'
- name: require-k8s-connectivity
value: 'false'
@@ -68,13 +68,13 @@
failureThreshold: 10
timeoutSeconds: 5
readinessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9879
+ port: health
scheme: HTTP
httpHeaders:
- name: brief
value: 'true'
periodSeconds: 30
successThreshold: 1
@@ -133,12 +133,17 @@
fi
echo 'Done!'
preStop:
exec:
command:
- /cni-uninstall.sh
+ ports:
+ - name: health
+ containerPort: 9879
+ hostPort: 9879
+ protocol: TCP
securityContext:
seLinuxOptions:
level: s0
type: spc_t
capabilities:
add:
@@ -185,13 +190,13 @@
- name: xtables-lock
mountPath: /run/xtables.lock
- name: tmp
mountPath: /tmp
initContainers:
- name: config
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
command:
- cilium-dbg
- build-config
env:
- name: K8S_NODE_NAME
@@ -209,22 +214,28 @@
- name: KUBERNETES_SERVICE_PORT
value: '6443'
volumeMounts:
- name: tmp
mountPath: /tmp
terminationMessagePolicy: FallbackToLogsOnError
+ securityContext:
+ capabilities:
+ add:
+ - NET_ADMIN
+ drop:
+ - ALL
- name: mount-cgroup
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
env:
- name: CGROUP_ROOT
value: /run/cilium/cgroupv2
- name: BIN_PATH
value: /opt/cni/bin
command:
- - sh
+ - bash
- -ec
- |
cp /usr/bin/cilium-mount /hostbin/cilium-mount;
nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT;
rm /hostbin/cilium-mount
volumeMounts:
@@ -242,19 +253,19 @@
- SYS_ADMIN
- SYS_CHROOT
- SYS_PTRACE
drop:
- ALL
- name: apply-sysctl-overwrites
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
env:
- name: BIN_PATH
value: /opt/cni/bin
command:
- - sh
+ - bash
- -ec
- |
cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
rm /hostbin/cilium-sysctlfix
volumeMounts:
@@ -272,13 +283,13 @@
- SYS_ADMIN
- SYS_CHROOT
- SYS_PTRACE
drop:
- ALL
- name: mount-bpf-fs
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
args:
- mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
command:
- /bin/bash
- -c
@@ -288,13 +299,13 @@
privileged: true
volumeMounts:
- name: bpf-maps
mountPath: /sys/fs/bpf
mountPropagation: Bidirectional
- name: clean-cilium-state
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
command:
- /init-container.sh
env:
- name: CILIUM_ALL_STATE
valueFrom:
@@ -336,17 +347,20 @@
- name: cilium-cgroup
mountPath: /run/cilium/cgroupv2
mountPropagation: HostToContainer
- name: cilium-run
mountPath: /var/run/cilium
- name: install-cni-binaries
- image: quay.io/cilium/cilium:v1.18.5@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
+ image: quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
imagePullPolicy: IfNotPresent
command:
- /install-plugin.sh
resources:
+ limits:
+ cpu: 1
+ memory: 1Gi
requests:
cpu: 100m
memory: 10Mi
securityContext:
seLinuxOptions:
level: s0
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy
+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium-envoy
@@ -28,13 +28,13 @@
spec:
securityContext:
appArmorProfile:
type: Unconfined
containers:
- name: cilium-envoy
- image: quay.io/cilium/cilium-envoy:v1.34.12-1765374555-6a93b0bbba8d6dc75b651cbafeedb062b2997716@sha256:3108521821c6922695ff1f6ef24b09026c94b195283f8bfbfc0fa49356a156e1
+ image: quay.io/cilium/cilium-envoy:v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa@sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d
imagePullPolicy: IfNotPresent
command:
- /usr/bin/cilium-envoy-starter
args:
- --
- -c /var/run/cilium/envoy/bootstrap-config.json
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator
+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator
@@ -20,25 +20,25 @@
maxSurge: 25%
maxUnavailable: 50%
type: RollingUpdate
template:
metadata:
annotations:
- cilium.io/cilium-configmap-checksum: 0aaec65d6662e6a0823e80c87180cdd90a34513c222faec286e03d6e170bf382
+ cilium.io/cilium-configmap-checksum: 832590e13e507f2e137adfb34f6a3a60a5ffa708280b5ea31a4d4d614415ee14
labels:
io.cilium/app: operator
name: cilium-operator
app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: cilium-operator
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: cilium-operator
- image: quay.io/cilium/operator-generic:v1.18.5@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99
+ image: quay.io/cilium/operator-generic:v1.19.3@sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd
imagePullPolicy: IfNotPresent
command:
- cilium-operator-generic
args:
- --config-dir=/tmp/cilium/config-map
- --debug=$(CILIUM_DEBUG)
@@ -60,26 +60,30 @@
name: cilium-config
optional: true
- name: KUBERNETES_SERVICE_HOST
value: qgr1-k8s.mole-bowfin.ts.net
- name: KUBERNETES_SERVICE_PORT
value: '6443'
+ ports:
+ - name: health
+ containerPort: 9234
+ hostPort: 9234
livenessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9234
+ port: health
scheme: HTTP
initialDelaySeconds: 60
periodSeconds: 10
timeoutSeconds: 3
readinessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9234
+ port: health
scheme: HTTP
initialDelaySeconds: 0
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 5
volumeMounts:
--- HelmRelease: kube-system/cilium Role: kube-system/cilium-operator-ztunnel
+++ HelmRelease: kube-system/cilium Role: kube-system/cilium-operator-ztunnel
@@ -0,0 +1,20 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: cilium-operator-ztunnel
+ namespace: kube-system
+ labels:
+ app.kubernetes.io/part-of: cilium
+rules:
+- apiGroups:
+ - apps
+ resources:
+ - daemonsets
+ verbs:
+ - create
+ - delete
+ - get
+ - list
+ - watch
+
--- HelmRelease: kube-system/cilium RoleBinding: kube-system/cilium-operator-ztunnel
+++ HelmRelease: kube-system/cilium RoleBinding: kube-system/cilium-operator-ztunnel
@@ -0,0 +1,17 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: cilium-operator-ztunnel
+ namespace: kube-system
+ labels:
+ app.kubernetes.io/part-of: cilium
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: cilium-operator-ztunnel
+subjects:
+- kind: ServiceAccount
+ name: cilium-operator
+ namespace: kube-system
+ |
qgr1-cluster-0 - kustomization--- k8s/base/kube-system/cilium Kustomization: flux-system/kube-system-cilium HelmRelease: kube-system/cilium
+++ k8s/base/kube-system/cilium Kustomization: flux-system/kube-system-cilium HelmRelease: kube-system/cilium
@@ -13,13 +13,13 @@
spec:
chart: cilium
sourceRef:
kind: HelmRepository
name: cilium-charts
namespace: flux-system
- version: 1.18.5
+ version: 1.19.3
install:
createNamespace: true
remediation:
retries: 50
timeout: 15m
interval: 30m |
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
a7e4449 to
c603ce0
Compare
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
c603ce0 to
92ffb93
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
92ffb93 to
ea44c45
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
ea44c45 to
a1252cb
Compare
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
a1252cb to
b86f741
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
b86f741 to
5baea4a
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/cilium-1.x
branch
from
5baea4a to
6847013
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.18.5→1.19.3Release Notes
cilium/cilium (cilium)
v1.19.3Compare Source
v1.19.2: 1.19.2Compare Source
Summary of Changes
Minor Changes:
Bugfixes:
ip get -l reserved:host(Backport PR #44517, Upstream PR #44443, @aanm)loadbalanceroption than intended (Backport PR #44699, Upstream PR #42916, @mliner)CI Changes:
Misc Changes:
--versionin Helm OCI install/upgrade documentation examples. (Backport PR #44398, Upstream PR #44380, @gma1k)0f775a3(v1.19) (#44570, @cilium-renovate[bot])15301c2(v1.19) (#44785, @cilium-renovate[bot])6a4a49e(v1.19) (#44672, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.2@​sha256:7bc7e0be845cae0a70241e622cd03c3b169001c9383dd84329c59ca86a8b1341clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.2@​sha256:d1f44a78a0d0996ab1841f7564bc6fbd6e242d4ef673a2a8bfdd7385ef68018ddocker-plugin
quay.io/cilium/docker-plugin:v1.19.2@​sha256:1ba743852ab063d83955c3917d75b2d296ff78d944d09fc1802f85f07ebee334hubble-relay
quay.io/cilium/hubble-relay:v1.19.2@​sha256:9987c73bad48c987fd065185535fd15a6717cbe8a8caf7fc7ef0413532cf490eoperator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.2@​sha256:90bdedf6b0d3108245f8194f8c69262af2c8d839480f99d2396deed057899142operator-aws
quay.io/cilium/operator-aws:v1.19.2@​sha256:6eaa299ad267d7b8fcb4bb17ee1008b391052e2e35f690b21783b1b23b5c0bf2operator-azure
quay.io/cilium/operator-azure:v1.19.2@​sha256:9c040a57f4584782eda9a91f7cf3292ca5d0fb41d75f4aa41ece29d66e145293operator-generic
quay.io/cilium/operator-generic:v1.19.2@​sha256:e363f4f634c2a66a36e01618734ea17e7b541b949b9a5632f9c180ab16de23f0operator
quay.io/cilium/operator:v1.19.2@​sha256:56ea76f4c1dfc8a899581b35bb2fc87b3110ee57ff0ab4003ae26d5a27d81448v1.19.1: 1.19.1Compare Source
Summary of Changes
Bugfixes:
operator.enabled=falseby aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals (Backport PR #44280, Upstream PR #44159, @puwun)CI Changes:
kernelto workflow job names (Backport PR #44127, Upstream PR #44291, @smagnani96)Misc Changes:
b3255e7(v1.19) (#44242, @cilium-renovate[bot])85c0ab0(v1.19) (#44364, @cilium-renovate[bot])f9f84bd(v1.19) (#44243, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.1@​sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.1@​sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28docker-plugin
quay.io/cilium/docker-plugin:v1.19.1@​sha256:6edfbf46ca484b1ed961f3c7382159ba7f0227e7af692159e99e8d4810ecaf34hubble-relay
quay.io/cilium/hubble-relay:v1.19.1@​sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.1@​sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554operator-aws
quay.io/cilium/operator-aws:v1.19.1@​sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804operator-azure
quay.io/cilium/operator-azure:v1.19.1@​sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8operator-generic
quay.io/cilium/operator-generic:v1.19.1@​sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211aoperator
quay.io/cilium/operator:v1.19.1@​sha256:93a6306d4543f1d8eccd79d6770c00ef4d4791f66326d97f9851f9d316e70141v1.19.0: 1.19.0Compare Source
🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.19.0 release!
A total of 2934 new commits have been contributed to this release by a growing community of over 1010 developers and over 23,600 GitHub stars! 🤩
The full changelog can be found here.
Here are some of the highlights:
🛡️ Network Policy
**.) to match multilevel subdomain as pattern prefix. (cilium/cilium#43420, @fristonio)ToRequiresandFromRequirespolicy fields. (cilium/cilium#43167, @sayboras; cilium/cilium#40967, @TheBeeZee)🔒 Encryption & Authentication
🚠 Networking
🕸️ Services and Service Mesh
🛣️ Border Gateway Protocol (BGP)
sourceInterfaceto allow binding the BGP connection to the loopback address which is not tied to the specific physical interface's lifecycle (cilium/cilium#42583, @rastislavs)externalTrafficPolicy=Cluster(cilium/cilium#40717, @oblazek)cilium.io/v2API: The support for the olderCiliumBGPPeeringPolicyv1 API is now removed and should be replaced with v2 APIs. (cilium/cilium#42278, @rastislavs)🛰️ Observability
hubblecommand line to understand the encryption status of the traffic, either--encryptedor--unencrypted. (cilium/cilium#43096, @SRodi)🌅 Performance and Scale
⚙️ Operations
quay.io/cilium/charts/cilium(cilium/cilium#43624, @aanm)🏠 Community
To keep up to date with all the latest Cilium releases, join #release 🎉
🎂❤️❤️❤️🎂
This is a very special release for Cilium, as it celebrates 10 years since the first commit. We couldn’t be more proud of what this project has accomplished. All the GitHub issues, pull requests, reviews, stars, forks, Docker pulls, Helm installs, Kubernetes applies, CI runs, bug reports, design docs, discussions, meetings, Slack messages, YouTube streams, eCHO episodes, conference talks, blog posts, demos, and presentations have made the project the success it is today.
🎂❤️❤️❤️🎂
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.0@​sha256:be9f8571c2e114b3e12e41f785f2356ade703b2eac936aa878805565f0468c60clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.0@​sha256:0e3b89fdb116eb0f5579fe8ee3fabb1a7c4d97987a1ae927491d9185785d4a49docker-plugin
quay.io/cilium/docker-plugin:v1.19.0@​sha256:35727047384f3d7a2684885003b266bf7a7add8fc66ca564b222f71c16057f50hubble-relay
quay.io/cilium/hubble-relay:v1.19.0@​sha256:7f17e5bb51a9f35bbc8e7a9ad5e347f03ff8003c2e5cc81171e8727a10bf03b4operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.0@​sha256:5cb3d6981c233616037f3e13b5bc0020d114ad8db1b7360618b224e4c0b02ef0operator-aws
quay.io/cilium/operator-aws:v1.19.0@​sha256:7a236ae256a4fbd3f72d516921131eba5b43f401ba37cdee5cd0e8c26f9263e6operator-azure
quay.io/cilium/operator-azure:v1.19.0@​sha256:6ae7e0d75c74836af3600b775201c89ea7fcc13d6e08fdb0c52927309f31cd2aoperator-generic
quay.io/cilium/operator-generic:v1.19.0@​sha256:5b04006015e5800307dc6314676edc4c0bb7ac2fc7848be2b94b43bb030ab648operator
quay.io/cilium/operator:v1.19.0@​sha256:deca84f442752dca0745dd09b13e8004569414839019ad79ac58f9fcaa3b9d65v1.18.9Compare Source
v1.18.8: 1.18.8Compare Source
Known issues
Summary of Changes
Minor Changes:
Bugfixes:
ip get -l reserved:host(Backport PR #44519, Upstream PR #44443, @aanm)CI Changes:
Misc Changes:
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.