envoy: Update to Envoy 1.27.0, drop privileges #27498
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
3 times, most recently
from
863b13b to
3512a87
Compare
|
/test |
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
from
3512a87 to
fad0f46
Compare
|
/test |
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
2 times, most recently
from
f553ec5 to
654f7d6
Compare
jrajahalme
added
the
release-note/minor
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
from
654f7d6 to
18dff86
Compare
|
/test |
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
from
18dff86 to
e17b791
Compare
|
/test |
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
from
e17b791 to
94e029a
Compare
|
/test |
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
from
94e029a to
7568e69
Compare
|
/test |
jrajahalme
force-pushed
the
envoy-drop-privileges
branch
from
7568e69 to
2974474
Compare
|
/test |
|
Unrelated flake in Travis CI, restarted |
mhofstetter
added a commit
to mhofstetter/cilium
that referenced
this pull request
Nov 30, 2023
With the introduction of the envoy starter (cilium#27498), the Envoy version check of the embedded mode calls out to the starter binary instead of the envoy binary directly. Depending on the permissions the agent runs with, the capabilities check within the starter might fail. To prevent unexpected errors, this commit re-introduces that the Envoy version check is performed on the Envoy binary directly. Signed-off-by: Marco Hofstetter <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Dec 4, 2023
With the introduction of the envoy starter (#27498), the Envoy version check of the embedded mode calls out to the starter binary instead of the envoy binary directly. Depending on the permissions the agent runs with, the capabilities check within the starter might fail. To prevent unexpected errors, this commit re-introduces that the Envoy version check is performed on the Envoy binary directly. Signed-off-by: Marco Hofstetter <[email protected]>
pjablonski123
pushed a commit
to pjablonski123/cilium
that referenced
this pull request
Dec 15, 2023
With the introduction of the envoy starter (cilium#27498), the Envoy version check of the embedded mode calls out to the starter binary instead of the envoy binary directly. Depending on the permissions the agent runs with, the capabilities check within the starter might fail. To prevent unexpected errors, this commit re-introduces that the Envoy version check is performed on the Envoy binary directly. Signed-off-by: Marco Hofstetter <[email protected]>
2 tasks
mhofstetter
added a commit
to mhofstetter/cilium
that referenced
this pull request
Jan 24, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumpfs the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: cilium#27498 Signed-off-by: Marco Hofstetter <[email protected]>
mhofstetter
added a commit
to mhofstetter/cilium
that referenced
this pull request
Jan 24, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumps the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: cilium#27498 Signed-off-by: Marco Hofstetter <[email protected]>
mhofstetter
added a commit
to mhofstetter/cilium
that referenced
this pull request
Jan 24, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumps the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: cilium#27498 Signed-off-by: Marco Hofstetter <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Jan 25, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumps the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: #27498 Signed-off-by: Marco Hofstetter <[email protected]>
mhofstetter
added a commit
to mhofstetter/cilium
that referenced
this pull request
Jan 26, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumps the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: cilium#27498 Signed-off-by: Marco Hofstetter <[email protected]>
joestringer
pushed a commit
that referenced
this pull request
Jan 26, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumps the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: #27498 Signed-off-by: Marco Hofstetter <[email protected]>
sayboras
added
backport/author
2 tasks
4 tasks
github-actions
bot
added
the
backport-done/1.14
sayboras
added
the
backport-done/1.13
julianwiedmann
removed
needs-backport/1.13
needs-backport/1.14
sayboras
pushed a commit
that referenced
this pull request
Jun 10, 2024
Currently, if BPF TPROXY is enabled (`bpf.tproxy=true`), the BPF socket lookup for the proxy port fails because Envoys Proxy listener socket is always configured with the socket option `SO_REUSEPORT`. It ignores the fact that port reuse on the Listener socket is explicitly disabled via Envoy Listener API (`enable_reuse_port=false`) if BPF TPROXY is enabled (due to incompatibilities). Therefore, this commit bumps the envoy image to the latest version that doesn't set the socket option `SO_REUSEPORT` on the Listener socket. Relates: cilium/proxy#505 Fixes: #27498 Signed-off-by: Marco Hofstetter <[email protected]> Signed-off-by: Michi Mutsuzaki <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Use
cilium-envoy-starterimage that runscilium-envoyprocess without any privileges.cilium-envoy-starterretains privileges to be able to integrate with Cilium BPF datapath.Review notes: