From 9755ad92421c85f17b1160a7c7188784ce005f88 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Thu, 31 Aug 2023 10:33:32 -0700 Subject: [PATCH] Revert "Prepare for release v1.15.0-pre.0" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 6375d28442800ec27a139d6b4779aa9ff87bd84e. Signed-off-by: André Martins Signed-off-by: Joe Stringer --- CHANGELOG.md | 444 -------------------------- Documentation/helm-values.rst | 32 +- VERSION | 2 +- install/kubernetes/cilium/Chart.yaml | 4 +- install/kubernetes/cilium/README.md | 34 +- install/kubernetes/cilium/values.yaml | 56 ++-- 6 files changed, 64 insertions(+), 508 deletions(-) delete mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index 103bbe0667547..0000000000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,444 +0,0 @@ -# Changelog - -## v1.15.0-pre.0 - -Summary of Changes ------------------- - -**Major Changes:** -* Add support for k8s 1.28 (#27361, @aanm) -* bgpv1: Add `bgp/routes` API endpoint and `cilium bgp routes` CLI command (#27182, @rastislavs) -* Introduce ability to specify SAFI/AFI for specific BGP peers. (#26940, @ldelossa) -* Module Health: Node Manager: First Iteration (#25994, @tommyp1ckles) - -**Minor Changes:** -* *_kvstore_operations_duration_seconds metrics do not include client-side rate-limiting latency anymore. (#27396, @marseel) -* .github/workflows: don't error out if pkill finds no processes (#26357, @lmb) -* .github: dump buddyinfo and pagetypeinfo when ci-e2e fails (#26600, @lmb) -* Add `cilium bpf auth flush` command for debugging purposes (#27216, @meyskens) -* Add an option to specify a filters and field mask for hubble-exporter (#26379, @AwesomePatrol) -* Add documentation of Hubble exporter - an option to save Hubble flows to a file (#27610, @AwesomePatrol) -* Add per-controller success/failure count metrics and a config option for these (#26850, @asauber) -* Add Prometheus map pressure metrics for NAT maps (#27001, @derailed) -* Add securityContext for spire pod in helm chart (#27363, @ishuar) -* Add source and destination workload_kind context labels (Hubble). (#27350, @marqc) -* Add SPIRE connection to `cilium status` (#26896, @meyskens) -* Add strict mode for WireGuard Pod2Pod encryption (#21856, @3u13r) -* Added the EnableHealthCheckLoadBalancerIP flag to address health checks on LoadBalancerIP in Google Cloud Platform using KubeProxyReplacement. (#26728, @nberlee) -* api: Add extensions field to observer.GetFlowsRequest and flow.Flows types (#27577, @chancez) -* Augments `cilium status` CLI to report on agent modules health status. (#25714, @derailed) -* bpf: allow overriding Makefile variables (#27492, @lmb) -* bpf: compile test ENABLE_EGRESS_GATEWAY_COMMON (#27515, @lmb) -* bpf: gate egressgw datapath on separate defines (#27189, @lmb) -* bpgv1: move the internal BGP signaler to a cell and allow other cells to depend on it. (#26745, @ldelossa) -* Change the Helm values configuration for SPIRE to match other images in the Helm charts (#27621, @weizhoublue) -* cilium/cmd: make output of 'cilium policy selectors' sorted. (#27803, @tommyp1ckles) -* cilium: export intermediate cobra.Commands (#26265, @lmb) -* cilium: use absolute path to include Makefile.defs (#27054, @lmb) -* cli: Update `cilium policy import` to allow policy replacement by label (#27103, @deverton-godaddy) -* clustermesh-apiserver deployment support lifecycle and terminationGracePeriodSeconds. (#26945, @acgs771126) -* daemon: Do not require native routing CIDR if ipmasq-agent is enabled (#27747, @gandro) -* docs, cilium: Remove `cilium endpoint regenerate` command (#27326, @christarazi) -* egressgw: inject datapath config via hive (#27414, @lmb) -* egressgw: refactor check for conflicting egress IPs (#27491, @lmb) -* egressgw: tidy up Config handling (#27221, @lmb) -* endpoint, endpointmanager: Publish max policymap size as metric (#27367, @christarazi) -* envoy: Bump envoy to 1.26.2 (#26851, @sayboras) -* envoy: Bump envoy version to v1.26.4 (#27104, @sayboras) -* envoy: Update envoy version to the latest build (#27819, @jrajahalme) -* Extend AWS metadata-based policy enforcement to work with any VPC-enabled service. (#27071, @spacepants) -* Fix LookupReservedIdentityByLabels function to return consistent results (#26795, @skmatti) -* gateway-api: Bump version to v0.8.0-rc1 (#27592, @sayboras) -* Hubble: improve security by adding an option to redact API key in Kafka requests (L7) (#25844, @ioandr) -* hubble: replace deprecated usage of grpc.WithInsecure. (#25631, @tommyp1ckles) -* Increase number of dnsproxy mutexes from 128 to 131. (#27147, @marseel) -* ipam, metrics: Add new capacity metric (#27710, @christarazi) -* Modular daemon and operator (#25986, @pippolo84) -* Refactor hubble redact settings schema (#26989, @ChrsMark) -* Refactor hubble redact settings schema [v2] (#27553, @ChrsMark) -* Remove deprecate clustermesh CA configuration from the helm chart (#27162, @giorio94) -* When BGP control plane is enabled and configured for service announcements, it will only advertise a matching service that has an unspecified loadbalancerClass or set for "io.cilium/bgp-control-plane". (#26905, @danehans) - -**Bugfixes:** -* Add a 5 second timeout to the Mutual Auth TCP handshake (#26650, @meyskens) -* bgpv1: fix manager_test.go build error (#27543, @ldelossa) -* bpf: nat: set .from_local_endpoint for all inter-cluster SNAT traffic (#26853, @julianwiedmann) -* bpf: nodeport: add RevDNAT-based FIB lookup for reply traffic (#26638, @julianwiedmann) -* bug: In dual-stack mode (both IPv4 and IPv6 are enabled), Cilium incorrectly converted CIDRs that covered all possible addresses for an IP Family (e.g. 0.0.0.0/0) to the "reserved:world" entity. Both IP families must be completely covered for "reserved:world" to apply. This resulted in dual-stack mode network policies that could not distinguish between world IPv4 and IPv6 traffic, treating them as one entity instead. (#22625, @nathanjsweet) -* cleanup: can clean the bpf filters created by the cilium agent with lower version (#27373, @sofat1989) -* Do mutual authentication handshake again if mismatch between bpf map and cached map happens (#27241, @meyskens) -* egressgw: policy: ensure egressGateway field is not nil (#27802, @jibi) -* envoy: fix init order between accesslog and xDS server (#27617, @mhofstetter) -* Fix a bug that could cause an incorrect max. sequence number to be reported by `cilium encrypt status` when IPsec is enabled. (#27656, @pchaigno) -* Fix cilium-envoy ServiceMonitor port name (#27207, @pixiono) -* Fix connection disruption for IPsec during downgrade to v1.14 by attaching correct bpf program to devices. (#27480, @jschwinger233) -* Fix connectivity issues caused by missing conntrack entry when service pod connects to itself via clusterIP. (#27602, @julianwiedmann) -* Fix endpoint logger not formatting logs as JSON when daemon log format is set to JSON (#27263, @leblowl) -* Fix Gateway managed services not exposing all ports (#27695, @Managarmrr) -* Fix possible cross-cluster connection drops on agents restart when clustermesh is enabled (#27575, @giorio94) -* Fix potential cross-node connectivity issue when IPsec is enabled with ENI or Azure IPAM modes. (#26663, @gandro) -* Fixes a issue that IPsec key rotation can't be triggered. (#27694, @jschwinger233) -* Fixes an issue where an empty ControlPlaneState was used during registration of BGP speakers. This would cause reconciliation issues as the current state would be unknown. (#27117, @ldelossa) -* Handle `.status.conditions` on `Service`s using in accordance with KEP-1623 (#27399, @addreas) -* health: Update Cilium agent to listen on nodeip (#26845, @tamilmani1989) -* helm: fix envoy daemonset loglevel with multiple verbose debug groups (#27698, @mhofstetter) -* ingress: fix panic on ingress rule without HTTPIngressRule (#27818, @mhofstetter) -* ipam: when a CiliumNode is removed, delete node label from metrics. (#27713, @tommyp1ckles) -* metrics: fix potential conflict on metrics registration (#27007, @ysksuzuki) -* Prioritization of which DNS mappings to keep was suboptimal, leading to evictions of mappings related to alive connections, worsening performance of fqdn policies and causing spurious logging. (#27572, @bimmlerd) -* proxy: fix multiple envoy listeners for same proxyType (#27510, @mhofstetter) -* Read FQDNRejectResponseCode from config (#27362, @ayuspin) -* spire: add scheduling configurations to helm-chart (#27229, @tvonhacht-apple) - -**CI Changes:** -* .github: Remove Loki action (#26676, @joestringer) -* Add missing ariane trigger phrases (#27822, @tklauser) -* bpf/tests: Cover IPsec key rotations (#27185, @pchaigno) -* bpf: test: pktgen cleanups (#26776, @julianwiedmann) -* bpf: tests: add helpers for boilerplate code (#27429, @julianwiedmann) -* bpf: tests: add helpers for common patterns (#27134, @julianwiedmann) -* bpf: tests: improve CT checks for observed TCP flags (#26802, @julianwiedmann) -* build(deps): bump tornado from 6.2 to 6.3.3 in /Documentation (#27497, @dependabot[bot]) -* ci-ginkgo: conditionally skip fetching artifacts & junit report (#27081, @mhofstetter) -* ci-gke: adjust junit file names to matrix properties (#27072, @mhofstetter) -* CI: Add conn-disrupt-test action for reuse (#27567, @jschwinger233) -* CI: Add IPsec key rotation test (#27203, @jschwinger233) -* ci: add scheduled runs for Ariane workflows (#27687, @nbusseneau) -* ci: Automate generation and update of docs-builder image (#24121, @qmonnet) -* ci: fix checking `github.event.pull_request.head.sha` (#26775, @mhofstetter) -* ci: increase junit artifact retention from 2 to 5 days (#27021, @mhofstetter) -* CI: Move IPsec CI jobs into separate pipelines (#26730, @jschwinger233) -* CI: Rename workflow names (#27391, @brlbil) -* ci: replace GHA action Sibz/github-status-action (#26976, @mhofstetter) -* ci: Run documentation workflow on README.rst updates (#26559, @qmonnet) -* ci: upload and publish JUnit test results for conformance-multi-pool (#27025, @mhofstetter) -* ci: use env variable to store branch name (#26779, @ferozsalam) -* datapath: Cover subnet encryption in XFRM leak test (#27212, @pchaigno) -* datapath: Fix TestNodeChurnXFRMLeaks (#27274, @brb) -* Disable the images digest when pushing the development helm chart (#27646, @giorio94) -* egressgw: back out test for policy conflict in ENI mode (#27432, @julianwiedmann) -* Extend Integration Test timeout (#27811, @YutaroHayakawa) -* Fix container scanning workflow (#26542, @ferozsalam) -* gh/actions: Customize cilium-config (#27416, @brb) -* gh/workflows: Fix setting endpoint routes in ci-e2e (#27384, @brb) -* Improve service unit test robustness (#26212, @strudelPi) -* ingress: Add conformance test for KPR=false (#27304, @sayboras) -* ipam: Fix race in NodeManager.Resync (#26963, @jaffcheng) -* jenkinsfiles: remove kubernetes upstream (#27349, @aanm) -* k8s: Replace generate-internal-groups.sh script (#27591, @sayboras) -* Make ci-ipsec-upgrade a part of /test (#27557, @jschwinger233) -* make: drop redundant `go vet ./...` from integration tests (#26565, @tklauser) -* node: Integration test for XFRM leaks on node churn (#27187, @pchaigno) -* Remove validation timeout in controlplane testing (#26414, @pippolo84) -* renovate: Pin cilium-cli version for = 1.16.0-0" icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg description: eBPF-based Networking, Security, and Observability diff --git a/install/kubernetes/cilium/README.md b/install/kubernetes/cilium/README.md index 00295ddc35e80..6a71d8aebd32d 100644 --- a/install/kubernetes/cilium/README.md +++ b/install/kubernetes/cilium/README.md @@ -1,6 +1,6 @@ # cilium -![Version: 1.15.0-pre.0](https://img.shields.io/badge/Version-1.15.0--pre.0-informational?style=flat-square) ![AppVersion: 1.15.0-pre.0](https://img.shields.io/badge/AppVersion-1.15.0--pre.0-informational?style=flat-square) +![Version: 1.15.0-dev](https://img.shields.io/badge/Version-1.15.0--dev-informational?style=flat-square) ![AppVersion: 1.15.0-dev](https://img.shields.io/badge/AppVersion-1.15.0--dev-informational?style=flat-square) Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as @@ -69,13 +69,13 @@ contributors across the globe, there is almost always someone available to help. | authentication.mutual.spire.connectionTimeout | string | `"30s"` | SPIRE connection timeout | | authentication.mutual.spire.enabled | bool | `false` | Enable SPIRE integration (beta) | | authentication.mutual.spire.install.agent.annotations | object | `{}` | SPIRE agent annotations | -| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:8eef9857bf223181ecef10d9bbcd2f7838f3689e9bd2445bede35066a732e823","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.6.3","useDigest":true}` | SPIRE agent image | +| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:8eef9857bf223181ecef10d9bbcd2f7838f3689e9bd2445bede35066a732e823","override":null,"pullPolicy":"Always","repository":"ghcr.io/spiffe/spire-agent","tag":"1.6.3","useDigest":true}` | SPIRE agent image | | authentication.mutual.spire.install.agent.labels | object | `{}` | SPIRE agent labels | | authentication.mutual.spire.install.agent.serviceAccount | object | `{"create":true,"name":"spire-agent"}` | SPIRE agent service account | | authentication.mutual.spire.install.agent.skipKubeletVerification | bool | `true` | SPIRE Workload Attestor kubelet verification. | | authentication.mutual.spire.install.agent.tolerations | list | `[]` | SPIRE agent tolerations configuration ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true | -| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:223ae047b1065bd069aac01ae3ac8088b3ca4a527827e283b85112f29385fb1b","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.35.0","useDigest":true}` | init container image of SPIRE agent and server | +| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:223ae047b1065bd069aac01ae3ac8088b3ca4a527827e283b85112f29385fb1b","override":null,"pullPolicy":"Always","repository":"docker.io/library/busybox","tag":"1.35.0","useDigest":true}` | init container image of SPIRE agent and server | | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into | | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration | | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations | @@ -85,7 +85,7 @@ contributors across the globe, there is almost always someone available to help. | authentication.mutual.spire.install.server.dataStorage.enabled | bool | `true` | Enable SPIRE server data storage | | authentication.mutual.spire.install.server.dataStorage.size | string | `"1Gi"` | Size of the SPIRE server data storage | | authentication.mutual.spire.install.server.dataStorage.storageClass | string | `nil` | StorageClass of the SPIRE server data storage | -| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:f4bc49fb0bd1d817a6c46204cc7ce943c73fb0a5496a78e0e4dc20c9a816ad7f","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.6.3","useDigest":true}` | SPIRE server image | +| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:f4bc49fb0bd1d817a6c46204cc7ce943c73fb0a5496a78e0e4dc20c9a816ad7f","override":null,"pullPolicy":"Always","repository":"ghcr.io/spiffe/spire-server","tag":"1.6.3","useDigest":true}` | SPIRE server image | | authentication.mutual.spire.install.server.initContainers | list | `[]` | SPIRE server init containers | | authentication.mutual.spire.install.server.labels | object | `{}` | SPIRE server labels | | authentication.mutual.spire.install.server.nodeSelector | object | `{}` | SPIRE server nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | @@ -131,7 +131,7 @@ contributors across the globe, there is almost always someone available to help. | bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY to reduce reliance on iptables rules for implementing Layer 7 policy. | | bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. | | bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. | -| certgen | object | `{"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"image":{"digest":"sha256:89a0847753686444daabde9474b48340993bd19c7bea66a46e45b2974b82041f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.9","useDigest":true},"podLabels":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. | +| certgen | object | `{"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"image":{"digest":"sha256:89a0847753686444daabde9474b48340993bd19c7bea66a46e45b2974b82041f","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/certgen","tag":"v0.1.9","useDigest":true},"podLabels":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. | | certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob | | certgen.extraVolumeMounts | list | `[]` | Additional certgen volumeMounts. | | certgen.extraVolumes | list | `[]` | Additional certgen volumes. | @@ -147,7 +147,7 @@ contributors across the globe, there is almost always someone available to help. | cluster.id | int | `0` | Unique ID of the cluster. Must be unique across all connected clusters and in the range of 1 to 255. Only required for Cluster Mesh, may be 0 if Cluster Mesh is not used. | | cluster.name | string | `"default"` | Name of the cluster. Only required for Cluster Mesh and mutual authentication with SPIRE. | | clustermesh.apiserver.affinity | object | `{"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"clustermesh-apiserver"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for clustermesh.apiserver | -| clustermesh.apiserver.etcd.image | object | `{"digest":"sha256:795d8660c48c439a7c3764c2330ed9222ab5db5bb524d8d0607cac76f7ba82a3","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/coreos/etcd","tag":"v3.5.4","useDigest":true}` | Clustermesh API server etcd image. | +| clustermesh.apiserver.etcd.image | object | `{"digest":"sha256:795d8660c48c439a7c3764c2330ed9222ab5db5bb524d8d0607cac76f7ba82a3","override":null,"pullPolicy":"Always","repository":"quay.io/coreos/etcd","tag":"v3.5.4","useDigest":true}` | Clustermesh API server etcd image. | | clustermesh.apiserver.etcd.init.resources | object | `{}` | Specifies the resources for etcd init container in the apiserver | | clustermesh.apiserver.etcd.lifecycle | object | `{}` | lifecycle setting for the etcd container | | clustermesh.apiserver.etcd.resources | object | `{}` | Specifies the resources for etcd container in the apiserver | @@ -156,12 +156,12 @@ contributors across the globe, there is almost always someone available to help. | clustermesh.apiserver.extraEnv | list | `[]` | Additional clustermesh-apiserver environment variables. | | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. | | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. | -| clustermesh.apiserver.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.15.0-pre.0","useDigest":false}` | Clustermesh API server image. | +| clustermesh.apiserver.image | object | `{"digest":"","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/clustermesh-apiserver-ci","tag":"latest","useDigest":false}` | Clustermesh API server image. | | clustermesh.apiserver.kvstoremesh.enabled | bool | `false` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. | | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. | | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. | | clustermesh.apiserver.kvstoremesh.extraVolumeMounts | list | `[]` | Additional KVStoreMesh volumeMounts. | -| clustermesh.apiserver.kvstoremesh.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/kvstoremesh","tag":"v1.15.0-pre.0","useDigest":false}` | KVStoreMesh image. | +| clustermesh.apiserver.kvstoremesh.image | object | `{"digest":"","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/kvstoremesh-ci","tag":"latest","useDigest":false}` | KVStoreMesh image. | | clustermesh.apiserver.kvstoremesh.lifecycle | object | `{}` | lifecycle setting for the KVStoreMesh container | | clustermesh.apiserver.kvstoremesh.resources | object | `{}` | Resource requests and limits for the KVStoreMesh container | | clustermesh.apiserver.kvstoremesh.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}` | KVStoreMesh Security context | @@ -317,7 +317,7 @@ contributors across the globe, there is almost always someone available to help. | envoy.extraVolumes | list | `[]` | Additional envoy volumes. | | envoy.healthPort | int | `9878` | TCP port for the health API. | | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s | -| envoy.image | object | `{"digest":"sha256:dbcb20bb208eb0031991f5c234eb6de567f95ebd814520dcbfda868b7c1af210","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.26.4-5a76016dde9a7b4d537f37e3ef84593ea1af87c7","useDigest":true}` | Envoy container image. | +| envoy.image | object | `{"digest":"sha256:dbcb20bb208eb0031991f5c234eb6de567f95ebd814520dcbfda868b7c1af210","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/cilium-envoy","tag":"v1.26.4-5a76016dde9a7b4d537f37e3ef84593ea1af87c7","useDigest":true}` | Envoy container image. | | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe | | envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe | | envoy.log.format | string | `"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"` | The format string to use for laying out the log message metadata of Envoy. | @@ -359,7 +359,7 @@ contributors across the globe, there is almost always someone available to help. | etcd.extraArgs | list | `[]` | Additional cilium-etcd-operator container arguments. | | etcd.extraVolumeMounts | list | `[]` | Additional cilium-etcd-operator volumeMounts. | | etcd.extraVolumes | list | `[]` | Additional cilium-etcd-operator volumes. | -| etcd.image | object | `{"digest":"sha256:04b8327f7f992693c2cb483b999041ed8f92efc8e14f2a5f3ab95574a65ea2dc","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-etcd-operator","tag":"v2.0.7","useDigest":true}` | cilium-etcd-operator image. | +| etcd.image | object | `{"digest":"sha256:04b8327f7f992693c2cb483b999041ed8f92efc8e14f2a5f3ab95574a65ea2dc","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/cilium-etcd-operator","tag":"v2.0.7","useDigest":true}` | cilium-etcd-operator image. | | etcd.k8sService | bool | `false` | If etcd is behind a k8s service set this option to true so that Cilium does the service translation automatically without requiring a DNS to be running. | | etcd.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-etcd-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | etcd.podAnnotations | object | `{}` | Annotations to be added to cilium-etcd-operator pods | @@ -422,7 +422,7 @@ contributors across the globe, there is almost always someone available to help. | hubble.relay.extraEnv | list | `[]` | Additional hubble-relay environment variables. | | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay | | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay | -| hubble.relay.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.15.0-pre.0","useDigest":false}` | Hubble-relay container image. | +| hubble.relay.image | object | `{"digest":"","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/hubble-relay-ci","tag":"latest","useDigest":false}` | Hubble-relay container image. | | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. | | hubble.relay.listenPort | string | `"4245"` | Port to listen to. | | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | @@ -479,7 +479,7 @@ contributors across the globe, there is almost always someone available to help. | hubble.ui.backend.extraEnv | list | `[]` | Additional hubble-ui backend environment variables. | | hubble.ui.backend.extraVolumeMounts | list | `[]` | Additional hubble-ui backend volumeMounts. | | hubble.ui.backend.extraVolumes | list | `[]` | Additional hubble-ui backend volumes. | -| hubble.ui.backend.image | object | `{"digest":"sha256:8a79a1aad4fc9c2aa2b3e4379af0af872a89fcec9d99e117188190671c66fc2e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-ui-backend","tag":"v0.12.0","useDigest":true}` | Hubble-ui backend image. | +| hubble.ui.backend.image | object | `{"digest":"sha256:8a79a1aad4fc9c2aa2b3e4379af0af872a89fcec9d99e117188190671c66fc2e","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/hubble-ui-backend","tag":"v0.12.0","useDigest":true}` | Hubble-ui backend image. | | hubble.ui.backend.livenessProbe.enabled | bool | `false` | Enable liveness probe for Hubble-ui backend (requires Hubble-ui 0.12+) | | hubble.ui.backend.readinessProbe.enabled | bool | `false` | Enable readiness probe for Hubble-ui backend (requires Hubble-ui 0.12+) | | hubble.ui.backend.resources | object | `{}` | Resource requests and limits for the 'backend' container of the 'hubble-ui' deployment. | @@ -489,7 +489,7 @@ contributors across the globe, there is almost always someone available to help. | hubble.ui.frontend.extraEnv | list | `[]` | Additional hubble-ui frontend environment variables. | | hubble.ui.frontend.extraVolumeMounts | list | `[]` | Additional hubble-ui frontend volumeMounts. | | hubble.ui.frontend.extraVolumes | list | `[]` | Additional hubble-ui frontend volumes. | -| hubble.ui.frontend.image | object | `{"digest":"sha256:1c876cfa1d5e35bc91e1025c9314f922041592a88b03313c22c1f97a5d2ba88f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-ui","tag":"v0.12.0","useDigest":true}` | Hubble-ui frontend image. | +| hubble.ui.frontend.image | object | `{"digest":"sha256:1c876cfa1d5e35bc91e1025c9314f922041592a88b03313c22c1f97a5d2ba88f","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/hubble-ui","tag":"v0.12.0","useDigest":true}` | Hubble-ui frontend image. | | hubble.ui.frontend.resources | object | `{}` | Resource requests and limits for the 'frontend' container of the 'hubble-ui' deployment. | | hubble.ui.frontend.securityContext | object | `{}` | Hubble-ui frontend security context. | | hubble.ui.frontend.server.ipv6 | object | `{"enabled":true}` | Controls server listener for ipv6 | @@ -516,7 +516,7 @@ contributors across the globe, there is almost always someone available to help. | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. | | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). | | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. | -| image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.15.0-pre.0","useDigest":false}` | Agent container image. | +| image | object | `{"digest":"","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/cilium-ci","tag":"latest","useDigest":false}` | Agent container image. | | imagePullSecrets | string | `nil` | Configure image pull secrets for pulling container images | | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set | | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. | @@ -601,7 +601,7 @@ contributors across the globe, there is almost always someone available to help. | nodeinit.extraEnv | list | `[]` | Additional nodeinit environment variables. | | nodeinit.extraVolumeMounts | list | `[]` | Additional nodeinit volumeMounts. | | nodeinit.extraVolumes | list | `[]` | Additional nodeinit volumes. | -| nodeinit.image | object | `{"override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"62093c5c233ea914bfa26a10ba41f8780d9b737f"}` | node-init image. | +| nodeinit.image | object | `{"override":null,"pullPolicy":"Always","repository":"quay.io/cilium/startup-script","tag":"62093c5c233ea914bfa26a10ba41f8780d9b737f"}` | node-init image. | | nodeinit.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for nodeinit pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | nodeinit.podAnnotations | object | `{}` | Annotations to be added to node-init pods. | | nodeinit.podLabels | object | `{}` | Labels to be added to node-init pods. | @@ -624,7 +624,7 @@ contributors across the globe, there is almost always someone available to help. | operator.extraVolumes | list | `[]` | Additional cilium-operator volumes. | | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. | | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. | -| operator.image | object | `{"alibabacloudDigest":"","awsDigest":"","azureDigest":"","genericDigest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.15.0-pre.0","useDigest":false}` | cilium-operator image. | +| operator.image | object | `{"alibabacloudDigest":"","awsDigest":"","azureDigest":"","genericDigest":"","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/operator","suffix":"-ci","tag":"latest","useDigest":false}` | cilium-operator image. | | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. | | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods | @@ -671,7 +671,7 @@ contributors across the globe, there is almost always someone available to help. | preflight.extraEnv | list | `[]` | Additional preflight environment variables. | | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. | | preflight.extraVolumes | list | `[]` | Additional preflight volumes. | -| preflight.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.15.0-pre.0","useDigest":false}` | Cilium pre-flight image. | +| preflight.image | object | `{"digest":"","override":null,"pullPolicy":"Always","repository":"quay.io/cilium/cilium-ci","tag":"latest","useDigest":false}` | Cilium pre-flight image. | | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods | | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ | diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml index 10bd8addaefc0..7a869280caf4e 100644 --- a/install/kubernetes/cilium/values.yaml +++ b/install/kubernetes/cilium/values.yaml @@ -143,9 +143,9 @@ rollOutCiliumPods: false # -- Agent container image. image: override: ~ - repository: "quay.io/cilium/cilium" - tag: "v1.15.0-pre.0" - pullPolicy: "IfNotPresent" + repository: "quay.io/cilium/cilium-ci" + tag: "latest" + pullPolicy: "Always" # cilium-digest digest: "" useDigest: false @@ -945,7 +945,7 @@ certgen: tag: "v0.1.9" digest: "sha256:89a0847753686444daabde9474b48340993bd19c7bea66a46e45b2974b82041f" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- Seconds after which the completed job pod will be deleted ttlSecondsAfterFinished: 1800 # -- Labels to be added to hubble-certgen pods @@ -1140,12 +1140,12 @@ hubble: # -- Hubble-relay container image. image: override: ~ - repository: "quay.io/cilium/hubble-relay" - tag: "v1.15.0-pre.0" + repository: "quay.io/cilium/hubble-relay-ci" + tag: "latest" # hubble-relay-digest digest: "" useDigest: false - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- Specifies the resources for the hubble-relay pods resources: {} @@ -1366,7 +1366,7 @@ hubble: tag: "v0.12.0" digest: "sha256:8a79a1aad4fc9c2aa2b3e4379af0af872a89fcec9d99e117188190671c66fc2e" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- Hubble-ui backend security context. securityContext: {} @@ -1405,7 +1405,7 @@ hubble: tag: "v0.12.0" digest: "sha256:1c876cfa1d5e35bc91e1025c9314f922041592a88b03313c22c1f97a5d2ba88f" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- Hubble-ui frontend security context. securityContext: {} @@ -1904,7 +1904,7 @@ envoy: override: ~ repository: "quay.io/cilium/cilium-envoy" tag: "v1.26.4-5a76016dde9a7b4d537f37e3ef84593ea1af87c7" - pullPolicy: "IfNotPresent" + pullPolicy: "Always" digest: "sha256:dbcb20bb208eb0031991f5c234eb6de567f95ebd814520dcbfda868b7c1af210" useDigest: true @@ -2188,7 +2188,7 @@ etcd: tag: "v2.0.7" digest: "sha256:04b8327f7f992693c2cb483b999041ed8f92efc8e14f2a5f3ab95574a65ea2dc" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- The priority class to use for cilium-etcd-operator priorityClassName: "" @@ -2290,7 +2290,7 @@ operator: image: override: ~ repository: "quay.io/cilium/operator" - tag: "v1.15.0-pre.0" + tag: "latest" # operator-generic-digest genericDigest: "" # operator-azure-digest @@ -2300,8 +2300,8 @@ operator: # operator-alibabacloud-digest alibabacloudDigest: "" useDigest: false - pullPolicy: "IfNotPresent" - suffix: "" + pullPolicy: "Always" + suffix: "-ci" # -- Number of replicas to run for the cilium-operator deployment replicas: 2 @@ -2489,7 +2489,7 @@ nodeinit: override: ~ repository: "quay.io/cilium/startup-script" tag: "62093c5c233ea914bfa26a10ba41f8780d9b737f" - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- The priority class to use for the nodeinit pod. priorityClassName: "" @@ -2576,12 +2576,12 @@ preflight: # -- Cilium pre-flight image. image: override: ~ - repository: "quay.io/cilium/cilium" - tag: "v1.15.0-pre.0" + repository: "quay.io/cilium/cilium-ci" + tag: "latest" # cilium-digest digest: "" useDigest: false - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- The priority class to use for the preflight pod. priorityClassName: "" @@ -2726,12 +2726,12 @@ clustermesh: # -- Clustermesh API server image. image: override: ~ - repository: "quay.io/cilium/clustermesh-apiserver" - tag: "v1.15.0-pre.0" + repository: "quay.io/cilium/clustermesh-apiserver-ci" + tag: "latest" # clustermesh-apiserver-digest digest: "" useDigest: false - pullPolicy: "IfNotPresent" + pullPolicy: "Always" etcd: # -- Clustermesh API server etcd image. @@ -2741,7 +2741,7 @@ clustermesh: tag: "v3.5.4" digest: "sha256:795d8660c48c439a7c3764c2330ed9222ab5db5bb524d8d0607cac76f7ba82a3" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- Specifies the resources for etcd container in the apiserver resources: {} @@ -2776,12 +2776,12 @@ clustermesh: # -- KVStoreMesh image. image: override: ~ - repository: "quay.io/cilium/kvstoremesh" - tag: "v1.15.0-pre.0" + repository: "quay.io/cilium/kvstoremesh-ci" + tag: "latest" # kvstoremesh-digest digest: "" useDigest: false - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- Additional KVStoreMesh arguments. extraArgs: [] @@ -3173,7 +3173,7 @@ authentication: tag: "1.35.0" digest: "sha256:223ae047b1065bd069aac01ae3ac8088b3ca4a527827e283b85112f29385fb1b" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # SPIRE agent configuration agent: # -- SPIRE agent image @@ -3183,7 +3183,7 @@ authentication: tag: "1.6.3" digest: "sha256:8eef9857bf223181ecef10d9bbcd2f7838f3689e9bd2445bede35066a732e823" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- SPIRE agent service account serviceAccount: create: true @@ -3205,7 +3205,7 @@ authentication: tag: "1.6.3" digest: "sha256:f4bc49fb0bd1d817a6c46204cc7ce943c73fb0a5496a78e0e4dc20c9a816ad7f" useDigest: true - pullPolicy: "IfNotPresent" + pullPolicy: "Always" # -- SPIRE server service account serviceAccount: create: true