Update to Cilium v1.15.0

Issue: https://github.com/rancher/rke2/issues/5354
Signed-off-by: Michael Fritch <mfritch@suse.com>
pull/403/head
Michael Fritch 2024-02-07 19:13:23 -07:00
parent 235c137fea
commit bd6faf3b91
No known key found for this signature in database
GPG Key ID: 75F3EB2E80A03B7F
14 changed files with 93 additions and 130 deletions

View File

@ -1,16 +1,16 @@
--- charts-original/Chart.yaml
+++ charts/Chart.yaml
@@ -124,8 +124,7 @@
@@ -81,8 +81,7 @@
apiVersion: v2
appVersion: 1.14.5
appVersion: 1.15.0
description: eBPF-based Networking, Security, and Observability
-home: https://cilium.io/
-icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.14/Documentation/images/logo-solo.svg
-icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.15/Documentation/images/logo-solo.svg
+home: https://docs.rke2.io/
keywords:
- BPF
- eBPF
@@ -135,7 +134,7 @@
@@ -92,7 +91,7 @@
- Observability
- Troubleshooting
kubeVersion: '>= 1.16.0-0'
@ -19,4 +19,4 @@
sources:
-- https://github.com/cilium/cilium
+- https://github.com/rancher/rke2-charts
version: 1.14.5
version: 1.15.0

View File

@ -12,7 +12,7 @@
{{- if and .Values.agent (not .Values.preflight.enabled) }}
{{- /* Default values with backwards compatibility */ -}}
@@ -83,7 +91,7 @@
@@ -87,7 +95,7 @@
{{- end }}
containers:
- name: cilium-agent
@ -21,7 +21,7 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- if .Values.sleepAfterInit }}
command:
@@ -372,7 +380,7 @@
@@ -386,7 +394,7 @@
{{- end }}
{{- if .Values.monitor.enabled }}
- name: cilium-monitor
@ -30,7 +30,7 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
command:
- /bin/bash
@@ -403,8 +411,18 @@
@@ -417,8 +425,18 @@
{{- toYaml .Values.extraContainers | nindent 6 }}
{{- end }}
initContainers:
@ -49,8 +49,8 @@
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.image }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
command:
- cilium
@@ -448,7 +466,7 @@
- cilium-dbg
@@ -465,7 +483,7 @@
# Required to mount cgroup2 filesystem on the underlying Kubernetes node.
# We use nsenter command with host's cgroup and mount namespaces enabled.
- name: mount-cgroup
@ -59,7 +59,7 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
env:
- name: CGROUP_ROOT
@@ -494,7 +512,7 @@
@@ -511,7 +529,7 @@
- ALL
{{- end}}
- name: apply-sysctl-overwrites
@ -68,7 +68,7 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- with .Values.initResources }}
resources:
@@ -543,7 +561,7 @@
@@ -560,7 +578,7 @@
# from a privileged container because the mount propagation bidirectional
# only works from privileged containers.
- name: mount-bpf-fs
@ -77,7 +77,7 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- with .Values.initResources }}
resources:
@@ -568,7 +586,7 @@
@@ -585,7 +603,7 @@
{{- end }}
{{- if and .Values.nodeinit.enabled .Values.nodeinit.bootstrapFile }}
- name: wait-for-node-init
@ -86,7 +86,7 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- with .Values.initResources }}
resources:
@@ -586,9 +604,11 @@
@@ -603,9 +621,11 @@
volumeMounts:
- name: cilium-bootstrap-file-dir
mountPath: "/tmp/cilium-bootstrap.d"
@ -99,16 +99,16 @@
imagePullPolicy: {{ .Values.image.pullPolicy }}
command:
- /init-container.sh
@@ -654,7 +674,7 @@
@@ -677,7 +697,7 @@
{{- end }}
{{- if and .Values.waitForKubeProxy (ne $kubeProxyReplacement "strict") }}
{{- if and .Values.waitForKubeProxy (and (ne $kubeProxyReplacement "strict") (ne $kubeProxyReplacement "true")) }}
- name: wait-for-kube-proxy
- image: {{ include "cilium.image" .Values.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.image }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- with .Values.initResources }}
resources:
@@ -692,7 +712,7 @@
@@ -715,7 +735,7 @@
{{- if .Values.cni.install }}
# Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent
- name: install-cni-binaries

View File

@ -11,8 +11,8 @@
+
{{- if and (.Values.agent) (not .Values.preflight.enabled) }}
{{- /* Default values with backwards compatibility */ -}}
{{- $defaultEnableCnpStatusUpdates := "true" -}}
@@ -269,7 +277,11 @@
{{- $defaultBpfMapDynamicSizeRatio := 0.0 -}}
@@ -289,7 +297,11 @@
# Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
# address.
@ -25,18 +25,16 @@
{{- if .Values.cleanState }}
# If a serious issue occurs during Cilium startup, this
@@ -439,7 +451,9 @@
@@ -463,6 +475,8 @@
tunnel-protocol: "vxlan"
{{- else if .Values.routingMode }}
routing-mode: {{ .Values.routingMode | quote }}
{{- else }}
- {{- if eq .Values.tunnel "disabled" }}
+{{- if not .Values.ipv4.enabled }}
+{{- else if not .Values.ipv4.enabled }}
+ routing-mode: "native"
+{{- else if eq .Values.tunnel "disabled" }}
routing-mode: "native"
{{- else if eq .Values.tunnel "vxlan" }}
{{- else }}
# Default case
routing-mode: "tunnel"
@@ -630,6 +644,8 @@
@@ -657,6 +671,8 @@
{{- if .Values.ipv6NativeRoutingCIDR }}
ipv6-native-routing-cidr: {{ .Values.ipv6NativeRoutingCIDR }}

View File

@ -1,6 +1,6 @@
--- charts-original/templates/cilium-envoy/daemonset.yaml
+++ charts/templates/cilium-envoy/daemonset.yaml
@@ -58,7 +58,7 @@
@@ -62,7 +62,7 @@
{{- end }}
containers:
- name: cilium-envoy
@ -8,4 +8,4 @@
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.envoy.image }}"
imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
command:
- /usr/bin/cilium-envoy
- /usr/bin/cilium-envoy-starter

View File

@ -1,6 +1,6 @@
--- charts-original/templates/cilium-nodeinit/daemonset.yaml
+++ charts/templates/cilium-nodeinit/daemonset.yaml
@@ -43,7 +43,7 @@
@@ -47,7 +47,7 @@
{{- end }}
containers:
- name: node-init

View File

@ -12,7 +12,7 @@
---
apiVersion: apps/v1
kind: Deployment
@@ -67,7 +74,7 @@
@@ -71,7 +78,7 @@
{{- end }}
containers:
- name: cilium-operator

View File

@ -1,6 +1,6 @@
--- charts-original/templates/cilium-preflight/daemonset.yaml
+++ charts/templates/cilium-preflight/daemonset.yaml
@@ -38,7 +38,7 @@
@@ -42,7 +42,7 @@
{{- end }}
initContainers:
- name: clean-cilium-state
@ -9,7 +9,7 @@
imagePullPolicy: {{ .Values.preflight.image.pullPolicy }}
command: ["/bin/echo"]
args:
@@ -46,7 +46,7 @@
@@ -50,7 +50,7 @@
terminationMessagePolicy: FallbackToLogsOnError
containers:
- name: cilium-pre-flight-check
@ -18,7 +18,7 @@
imagePullPolicy: {{ .Values.preflight.image.pullPolicy }}
command: ["/bin/sh"]
args:
@@ -97,7 +97,7 @@
@@ -106,7 +106,7 @@
terminationMessagePolicy: FallbackToLogsOnError
{{- if ne .Values.preflight.tofqdnsPreCache "" }}
- name: cilium-pre-flight-fqdn-precache

View File

@ -1,6 +1,6 @@
--- charts-original/templates/cilium-preflight/deployment.yaml
+++ charts/templates/cilium-preflight/deployment.yaml
@@ -33,7 +33,7 @@
@@ -37,7 +37,7 @@
{{- end }}
containers:
- name: cnp-validator

View File

@ -1,24 +1,24 @@
--- charts-original/templates/clustermesh-apiserver/deployment.yaml
+++ charts/templates/clustermesh-apiserver/deployment.yaml
@@ -44,7 +44,7 @@
@@ -48,7 +48,7 @@
{{- end }}
initContainers:
- name: etcd-init
- image: {{ include "cilium.image" .Values.clustermesh.apiserver.etcd.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.clustermesh.apiserver.etcd.image }}"
imagePullPolicy: {{ .Values.clustermesh.apiserver.etcd.image.pullPolicy }}
command: ["/bin/sh", "-c"]
args:
@@ -92,7 +92,7 @@
{{- end }}
- image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.clustermesh.apiserver.image }}"
imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
command:
- /usr/bin/clustermesh-apiserver
@@ -93,7 +93,7 @@
containers:
- name: etcd
- image: {{ include "cilium.image" .Values.clustermesh.apiserver.etcd.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.clustermesh.apiserver.etcd.image }}"
imagePullPolicy: {{ .Values.clustermesh.apiserver.etcd.image.pullPolicy }}
# The clustermesh-apiserver container image includes an etcd binary.
- image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.clustermesh.apiserver.image }}"
imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
command:
- /usr/local/bin/etcd
@@ -148,7 +148,7 @@
- /usr/bin/etcd
@@ -153,7 +153,7 @@
{{- toYaml . | nindent 10 }}
{{- end }}
- name: apiserver
@ -27,12 +27,12 @@
imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
command:
- /usr/bin/clustermesh-apiserver
@@ -226,7 +226,7 @@
@@ -240,7 +240,7 @@
{{- end }}
{{- if .Values.clustermesh.apiserver.kvstoremesh.enabled }}
- name: kvstoremesh
- image: {{ include "cilium.image" .Values.clustermesh.apiserver.kvstoremesh.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.clustermesh.apiserver.kvstoremesh.image }}"
imagePullPolicy: {{ .Values.clustermesh.apiserver.kvstoremesh.image.pullPolicy }}
- image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
+ image: "{{ template "system_default_registry" . }}{{ include "cilium.image" .Values.clustermesh.apiserver.image }}"
imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
command:
- /usr/bin/kvstoremesh
- /usr/bin/clustermesh-apiserver

View File

@ -1,6 +1,6 @@
--- charts-original/templates/etcd-operator/cilium-etcd-operator-deployment.yaml
+++ charts/templates/etcd-operator/cilium-etcd-operator-deployment.yaml
@@ -90,7 +90,7 @@
@@ -94,7 +94,7 @@
value: "revision"
- name: CILIUM_ETCD_META_ETCD_AUTO_COMPACTION_RETENTION
value: "25000"

View File

@ -1,6 +1,6 @@
--- charts-original/templates/hubble-relay/deployment.yaml
+++ charts/templates/hubble-relay/deployment.yaml
@@ -49,7 +49,7 @@
@@ -53,7 +53,7 @@
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}

View File

@ -1,6 +1,6 @@
--- charts-original/templates/hubble-ui/deployment.yaml
+++ charts/templates/hubble-ui/deployment.yaml
@@ -51,7 +51,7 @@
@@ -55,7 +55,7 @@
{{- end }}
containers:
- name: frontend
@ -9,7 +9,7 @@
imagePullPolicy: {{ .Values.hubble.ui.frontend.image.pullPolicy }}
ports:
- name: http
@@ -79,7 +79,7 @@
@@ -91,7 +91,7 @@
{{- toYaml . | trim | nindent 10 }}
{{- end }}
- name: backend

View File

@ -1,21 +1,21 @@
--- charts-original/values.yaml
+++ charts/values.yaml
@@ -142,12 +142,10 @@
@@ -145,12 +145,10 @@
# -- Agent container image.
image:
override: ~
- repository: "quay.io/cilium/cilium"
+ repository: "rancher/mirrored-cilium-cilium"
tag: "v1.14.5"
tag: "v1.15.0"
pullPolicy: "IfNotPresent"
- # cilium-digest
- digest: "sha256:d3b287029755b6a47dee01420e2ea469469f1b174a2089c10af7e5e9289ef05b"
- digest: "sha256:9cfd6a0a3a964780e73a11159f93cc363e616f7d9783608f62af6cfdf3759619"
- useDigest: true
+ useDigest: false
# -- Affinity for cilium-agent.
affinity:
@@ -537,7 +535,9 @@
@@ -549,7 +547,9 @@
# - flannel
# - generic-veth
# - portmap
@ -26,7 +26,7 @@
# -- A CNI network name in to which the Cilium plugin should be added as a chained plugin.
# This will cause the agent to watch for a CNI network with this network name. When it is
@@ -936,10 +936,9 @@
@@ -964,10 +964,9 @@
certgen:
image:
override: ~
@ -39,56 +39,56 @@
pullPolicy: "IfNotPresent"
# -- Seconds after which the completed job pod will be deleted
ttlSecondsAfterFinished: 1800
@@ -961,7 +960,7 @@
@@ -992,7 +991,7 @@
hubble:
# -- Enable Hubble (true by default).
- enabled: true
+ enabled: false
# -- Buffer size of the channel Hubble uses to receive monitor events. If this
# value is not set, the queue size is set to the default monitor queue size.
@@ -1112,11 +1111,9 @@
# -- Annotations to be added to all top-level hubble objects (resources under templates/hubble)
annotations: {}
@@ -1223,11 +1222,9 @@
# -- Hubble-relay container image.
image:
override: ~
- repository: "quay.io/cilium/hubble-relay"
+ repository: "rancher/mirrored-cilium-hubble-relay"
tag: "v1.14.5"
tag: "v1.15.0"
- # hubble-relay-digest
- digest: "sha256:dbef89f924a927043d02b40c18e417c1ea0e8f58b44523b80fef7e3652db24d4"
- digest: "sha256:45b3ea70b73aee01644f800b8f6138c36446bfb130d2b88b0f75775ebe6a9ab6"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
# -- Specifies the resources for the hubble-relay pods
@@ -1340,10 +1337,9 @@
@@ -1460,10 +1457,9 @@
# -- Hubble-ui backend image.
image:
override: ~
- repository: "quay.io/cilium/hubble-ui-backend"
+ repository: "rancher/mirrored-cilium-hubble-ui-backend"
tag: "v0.12.1"
- digest: "sha256:1f86f3400827a0451e6332262467f894eeb7caf0eb8779bd951e2caa9d027cbe"
tag: "v0.12.3"
- digest: "sha256:1cd84251cec46e20f9e839ee0afba9b51c8de59d35681234f701d7f42062f138"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
# -- Hubble-ui backend security context.
@@ -1371,10 +1367,9 @@
@@ -1499,10 +1495,9 @@
# -- Hubble-ui frontend image.
image:
override: ~
- repository: "quay.io/cilium/hubble-ui"
+ repository: "rancher/mirrored-cilium-hubble-ui"
tag: "v0.12.1"
- digest: "sha256:9e5f81ee747866480ea1ac4630eb6975ff9227f9782b7c93919c081c33f38267"
tag: "v0.12.3"
- digest: "sha256:e6b825302fc1e406b1305363fe0bcd1fdf95730b32c2b99a2b36dfa37bdaeec2"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
# -- Hubble-ui frontend security context.
@@ -1500,7 +1495,7 @@
@@ -1680,7 +1675,7 @@
ipam:
# -- Configure IP Address Management mode.
# ref: https://docs.cilium.io/en/stable/network/concepts/ipam/
@ -97,7 +97,7 @@
# -- Maximum rate at which the CiliumNode custom resource is updated.
ciliumNodeUpdateRate: "15s"
operator:
@@ -1778,7 +1773,7 @@
@@ -1974,7 +1969,7 @@
# -- Configure prometheus metrics on the configured port at /metrics
prometheus:
@ -106,21 +106,21 @@
port: 9962
serviceMonitor:
# -- Enable service monitors.
@@ -1856,11 +1851,10 @@
@@ -2063,11 +2058,10 @@
# -- Envoy container image.
image:
override: ~
- repository: "quay.io/cilium/cilium-envoy"
+ repository: "rancher/mirrored-cilium-cilium-envoy"
tag: "v1.26.6-ad82c7c56e88989992fd25d8d67747de865c823b"
tag: "v1.27.2-13f6142b9c02268b10d547c8b093ef16724538e3"
pullPolicy: "IfNotPresent"
- digest: "sha256:992998398dadfff7117bfa9fdb7c9474fefab7f0237263f7c8114e106c67baca"
- digest: "sha256:bf37c46d3d6bd5f51ff11d09de81671ced070e27912e080083c58a6d3fbb740f"
- useDigest: true
+ useDigest: false
# -- Additional containers added to the cilium Envoy DaemonSet.
extraContainers: []
@@ -2148,10 +2142,9 @@
@@ -2363,10 +2357,9 @@
# -- cilium-etcd-operator image.
image:
override: ~
@ -133,36 +133,27 @@
pullPolicy: "IfNotPresent"
# -- The priority class to use for cilium-etcd-operator
@@ -2253,17 +2246,9 @@
@@ -2471,17 +2464,9 @@
# -- cilium-operator image.
image:
override: ~
- repository: "quay.io/cilium/operator"
+ repository: "rancher/mirrored-cilium-operator"
tag: "v1.14.5"
tag: "v1.15.0"
- # operator-generic-digest
- genericDigest: "sha256:303f9076bdc73b3fc32aaedee64a14f6f44c8bb08ee9e3956d443021103ebe7a"
- genericDigest: "sha256:e26ecd316e742e4c8aa1e302ba8b577c2d37d114583d6c4cdd2b638493546a79"
- # operator-azure-digest
- azureDigest: "sha256:9203f5583aa34e716d7a6588ebd144e43ce3b77873f578fc12b2679e33591353"
- azureDigest: "sha256:498a9e940cddd4e58d401a13005b0784ed9597bfe1e5cf2f52b6ba9ccceee768"
- # operator-aws-digest
- awsDigest: "sha256:785ccf1267d0ed3ba9e4bd8166577cb4f9e4ce996af26b27c9d5c554a0d5b09a"
- awsDigest: "sha256:cf45167a8bb336c763046553c6a97c0d7f12f7e2a498dfb2340fa27832a81b3a"
- # operator-alibabacloud-digest
- alibabacloudDigest: "sha256:e0152c498ba73c56a82eee2a706c8f400e9a6999c665af31a935bdf08e659bc3"
- alibabacloudDigest: "sha256:ee03349caef5519f8e9123132cf17c85b771f8fff095c57f00a2af8bb3224b79"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
suffix: ""
@@ -2394,7 +2379,7 @@
# -- Enable prometheus metrics for cilium-operator on the configured port at
# /metrics
prometheus:
- enabled: false
+ enabled: true
port: 9963
serviceMonitor:
# -- Enable service monitors.
@@ -2430,8 +2415,7 @@
@@ -2653,8 +2638,7 @@
# -- Taint nodes where Cilium is scheduled but not running. This prevents pods
# from being scheduled to nodes where Cilium is not the default CNI provider.
@ -172,61 +163,35 @@
# -- Set Node condition NetworkUnavailable to 'false' with the reason
# 'CiliumIsUp' for nodes that have a healthy Cilium pod.
@@ -2540,11 +2524,9 @@
@@ -2766,11 +2750,9 @@
# -- Cilium pre-flight image.
image:
override: ~
- repository: "quay.io/cilium/cilium"
+ repository: "rancher/mirrored-cilium-cilium"
tag: "v1.14.5"
tag: "v1.15.0"
- # cilium-digest
- digest: "sha256:d3b287029755b6a47dee01420e2ea469469f1b174a2089c10af7e5e9289ef05b"
- digest: "sha256:9cfd6a0a3a964780e73a11159f93cc363e616f7d9783608f62af6cfdf3759619"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
# -- The priority class to use for the preflight pod.
@@ -2690,21 +2672,18 @@
@@ -2928,11 +2910,9 @@
# -- Clustermesh API server image.
image:
override: ~
- repository: "quay.io/cilium/clustermesh-apiserver"
+ repository: "rancher/mirrored-cilium-clustermesh-apiserver"
tag: "v1.14.5"
tag: "v1.15.0"
- # clustermesh-apiserver-digest
- digest: "sha256:7eaa35cf5452c43b1f7d0cde0d707823ae7e49965bcb54c053e31ea4e04c3d96"
- digest: "sha256:43feb49dfbaa82388dc653ce12c7626ce40ae375e9853d71b9f5cff0ce61d54a"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
etcd:
# -- Clustermesh API server etcd image.
image:
override: ~
- repository: "quay.io/coreos/etcd"
+ repository: "rancher/mirrored-coreos-etcd"
tag: "v3.5.4"
- digest: "sha256:795d8660c48c439a7c3764c2330ed9222ab5db5bb524d8d0607cac76f7ba82a3"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
# -- Specifies the resources for etcd container in the apiserver
@@ -2737,11 +2716,9 @@
# -- KVStoreMesh image.
image:
override: ~
- repository: "quay.io/cilium/kvstoremesh"
+ repository: "rancher/mirrored-cilium-kvstoremesh"
tag: "v1.14.5"
- # kvstoremesh-digest
- digest: "sha256:d7137edd0efa2b1407b20088af3980a9993bb616d85bf9b55ea2891d1b99023a"
- useDigest: true
+ useDigest: false
pullPolicy: "IfNotPresent"
# -- Additional KVStoreMesh arguments.
@@ -3222,3 +3199,11 @@
@@ -3501,3 +3481,11 @@
agentSocketPath: /run/spire/sockets/agent/agent.sock
# -- SPIRE connection timeout
connectionTimeout: 30s

View File

@ -1,2 +1,2 @@
url: https://helm.cilium.io/cilium-1.14.5.tgz
url: https://helm.cilium.io/cilium-1.15.0.tgz
packageVersion: 00