Skip to content

Commit 73e12de

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #534 from openshift-service-mesh-bot/none-master-merge_upstream_istio_master-6253864e
Automator: merge upstream changes to openshift-service-mesh/istio@master
2 parents 4c33fd5 + 8883415 commit 73e12de

File tree

261 files changed

+2661
-603
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

261 files changed

+2661
-603
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "istio build-tools",
3-
"image": "gcr.io/istio-testing/build-tools:master-4d8a6668b6d46b3becc35f9b24467f841bbb020a",
3+
"image": "gcr.io/istio-testing/build-tools:master-8dcf63149d5bdaa83d1407a121098e8e8d1626dd",
44
"privileged": true,
55
"remoteEnv": {
66
"USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

‎Makefile.core.mk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ endif
4949
export VERSION
5050

5151
# Base version of Istio image to use
52-
BASE_VERSION ?= master-2025-10-01T19-01-35
52+
BASE_VERSION ?= master-2025-11-06T19-00-48
5353
ISTIO_BASE_REGISTRY ?= gcr.io/istio-release
5454

5555
export GO111MODULE ?= on

‎cni/pkg/install/install.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,7 @@ func checkValidCNIConfig(ctx context.Context, cfg *config.InstallConfig, cniConf
304304
// first call of checkValidCNIConfig and we will return an error so the cni config file can be
305305
// created or rewritten
306306
if defaultCNIConfigFilepath != cniConfigFilepath {
307-
log.Infof("cniConfigFilePath mismatch: expected %s but found %s", defaultCNIConfigFilepath, cniConfigFilepath)
307+
log.Debugf("cniConfigFilePath mismatch: expected %s but found %s", defaultCNIConfigFilepath, cniConfigFilepath)
308308
if len(cfg.CNIConfName) > 0 || !cfg.ChainedCNIPlugin {
309309
// Install was run with overridden CNI config file so don't error out on preempt check
310310
// Likely the only use for this is testing the script

‎cni/pkg/ipset/nldeps_unspecified.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
//go:build !linux
2-
// +build !linux
32

43
// Copyright Istio Authors
54
//

‎cni/pkg/iptables/iptables_unspecified.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
//go:build !linux
2-
// +build !linux
32

43
// Copyright Istio Authors
54
//

‎cni/pkg/nftables/nftables.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ func (cfg *NftablesConfigurator) AppendInpodRules(podOverrides config.PodLevelOv
224224

225225
// CLI: nft add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip6 saddr
226226
// fd16:9254:7127:1337:ffff:ffff:ffff:ffff counter accept
227-
cfg.ruleBuilder.AppendRule(IstioPreroutingChain, AmbientNatTable,
227+
cfg.ruleBuilder.AppendV6RuleIfSupported(IstioPreroutingChain, AmbientNatTable,
228228
"meta l4proto tcp",
229229
"ip6 saddr", cfg.cfg.HostProbeV6SNATAddress.String(), Counter,
230230
"accept",
@@ -240,7 +240,7 @@ func (cfg *NftablesConfigurator) AppendInpodRules(podOverrides config.PodLevelOv
240240
)
241241

242242
// CLI: nft add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr fd16:9254:7127:1337:ffff:ffff:ffff:ffff counter accept
243-
cfg.ruleBuilder.AppendRule(IstioOutputChain, AmbientNatTable,
243+
cfg.ruleBuilder.AppendV6RuleIfSupported(IstioOutputChain, AmbientNatTable,
244244
"meta l4proto tcp",
245245
"ip6 daddr", cfg.cfg.HostProbeV6SNATAddress.String(), Counter,
246246
"accept",
@@ -259,7 +259,7 @@ func (cfg *NftablesConfigurator) AppendInpodRules(podOverrides config.PodLevelOv
259259
"redirect to", ":"+fmt.Sprint(config.ZtunnelInboundPlaintextPort),
260260
)
261261

262-
cfg.ruleBuilder.AppendRule(IstioPreroutingChain, AmbientNatTable,
262+
cfg.ruleBuilder.AppendV6RuleIfSupported(IstioPreroutingChain, AmbientNatTable,
263263
"ip6 daddr", "!=", "::1/128",
264264
"tcp dport", "!=", fmt.Sprint(config.ZtunnelInboundPort),
265265
"mark and 0xfff", "!=", fmt.Sprintf("0x%x", config.InpodMark), Counter,
@@ -301,7 +301,7 @@ func (cfg *NftablesConfigurator) AppendInpodRules(podOverrides config.PodLevelOv
301301
)
302302

303303
// CLI: nft add rule inet istio-ambient-nat istio-output ip6 daddr != ::1/128 tcp dport 53 mark and 0xfff != 0x539 counter redirect to :15053
304-
cfg.ruleBuilder.AppendRule(
304+
cfg.ruleBuilder.AppendV6RuleIfSupported(
305305
IstioOutputChain, AmbientNatTable,
306306
"ip6 daddr", "!=", "::1/128",
307307
"tcp dport", "53",
@@ -356,7 +356,7 @@ func (cfg *NftablesConfigurator) AppendInpodRules(podOverrides config.PodLevelOv
356356
)
357357

358358
// CLI: nft add rule inet istio-ambient-nat istio-output oifname "lo" ip6 daddr != ::1/128 counter accept
359-
cfg.ruleBuilder.AppendRule(
359+
cfg.ruleBuilder.AppendV6RuleIfSupported(
360360
IstioOutputChain, AmbientNatTable,
361361
"oifname", "lo",
362362
"ip6 daddr",
@@ -377,7 +377,7 @@ func (cfg *NftablesConfigurator) AppendInpodRules(podOverrides config.PodLevelOv
377377
"redirect to", ":"+fmt.Sprintf("%d", config.ZtunnelOutboundPort),
378378
)
379379

380-
cfg.ruleBuilder.AppendRule(
380+
cfg.ruleBuilder.AppendV6RuleIfSupported(
381381
IstioOutputChain, AmbientNatTable,
382382
"meta l4proto tcp",
383383
"ip6 daddr",
@@ -473,7 +473,7 @@ func (cfg *NftablesConfigurator) CreateHostRulesForHealthChecks() error {
473473
"ip", "daddr", fmt.Sprintf("@%s-v4", config.ProbeIPSet), Counter, "snat", "to", cfg.cfg.HostProbeSNATAddress.String())
474474

475475
// For V6 we have to use a different set and a different SNAT IP
476-
cfg.ruleBuilder.AppendRule(PostroutingChain, AmbientNatTable, "meta l4proto tcp", "skuid", kubeletUID,
476+
cfg.ruleBuilder.AppendV6RuleIfSupported(PostroutingChain, AmbientNatTable, "meta l4proto tcp", "skuid", kubeletUID,
477477
"ip6", "daddr", fmt.Sprintf("@%s-v6", config.ProbeIPSet), Counter, "snat", "to", cfg.cfg.HostProbeV6SNATAddress.String())
478478

479479
return util.RunAsHost(func() error {

‎cni/pkg/nftables/testdata/default.golden‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,13 @@ add chain inet istio-ambient-nat istio-output
77
add rule inet istio-ambient-nat output jump istio-output
88
add rule inet istio-ambient-nat prerouting jump istio-prerouting
99
add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip saddr 169.254.7.127 counter accept
10-
add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip6 saddr e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 counter accept
1110
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip daddr 169.254.7.127 counter accept
12-
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 counter accept
1311
add rule inet istio-ambient-nat istio-prerouting ip daddr != 127.0.0.1/32 tcp dport != 15008 mark and 0xfff != 0x539 counter redirect to :15006
14-
add rule inet istio-ambient-nat istio-prerouting ip6 daddr != ::1/128 tcp dport != 15008 mark and 0xfff != 0x539 counter redirect to :15006
1512
add rule inet istio-ambient-nat istio-output oifname != lo mark and 0xfff != 0x539 udp dport 53 counter redirect to :15053
1613
add rule inet istio-ambient-nat istio-output ip daddr != 127.0.0.1/32 tcp dport 53 mark and 0xfff != 0x539 counter redirect to :15053
17-
add rule inet istio-ambient-nat istio-output ip6 daddr != ::1/128 tcp dport 53 mark and 0xfff != 0x539 counter redirect to :15053
1814
add rule inet istio-ambient-nat istio-output meta l4proto tcp mark and 0xfff == 0x111 counter accept
1915
add rule inet istio-ambient-nat istio-output oifname lo ip daddr != 127.0.0.1/32 counter accept
20-
add rule inet istio-ambient-nat istio-output oifname lo ip6 daddr != ::1/128 counter accept
2116
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip daddr != 127.0.0.1/32 mark and 0xfff != 0x539 counter redirect to :15001
22-
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr != ::1/128 mark and 0xfff != 0x539 counter redirect to :15001
2317
add table inet istio-ambient-mangle
2418
flush table inet istio-ambient-mangle
2519
add chain inet istio-ambient-mangle prerouting { type filter hook prerouting priority -150 ; }

‎cni/pkg/nftables/testdata/dns_pod_disabled_and_on_globally.golden‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,11 @@ add chain inet istio-ambient-nat istio-output
77
add rule inet istio-ambient-nat output jump istio-output
88
add rule inet istio-ambient-nat prerouting jump istio-prerouting
99
add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip saddr 169.254.7.127 counter accept
10-
add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip6 saddr e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 counter accept
1110
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip daddr 169.254.7.127 counter accept
12-
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 counter accept
1311
add rule inet istio-ambient-nat istio-prerouting ip daddr != 127.0.0.1/32 tcp dport != 15008 mark and 0xfff != 0x539 counter redirect to :15006
14-
add rule inet istio-ambient-nat istio-prerouting ip6 daddr != ::1/128 tcp dport != 15008 mark and 0xfff != 0x539 counter redirect to :15006
1512
add rule inet istio-ambient-nat istio-output meta l4proto tcp mark and 0xfff == 0x111 counter accept
1613
add rule inet istio-ambient-nat istio-output oifname lo ip daddr != 127.0.0.1/32 counter accept
17-
add rule inet istio-ambient-nat istio-output oifname lo ip6 daddr != ::1/128 counter accept
1814
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip daddr != 127.0.0.1/32 mark and 0xfff != 0x539 counter redirect to :15001
19-
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr != ::1/128 mark and 0xfff != 0x539 counter redirect to :15001
2015
add table inet istio-ambient-mangle
2116
flush table inet istio-ambient-mangle
2217
add chain inet istio-ambient-mangle prerouting { type filter hook prerouting priority -150 ; }

‎cni/pkg/nftables/testdata/dns_pod_enabled_and_off_globally.golden‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,13 @@ add chain inet istio-ambient-nat istio-output
77
add rule inet istio-ambient-nat output jump istio-output
88
add rule inet istio-ambient-nat prerouting jump istio-prerouting
99
add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip saddr 169.254.7.127 counter accept
10-
add rule inet istio-ambient-nat istio-prerouting meta l4proto tcp ip6 saddr e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 counter accept
1110
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip daddr 169.254.7.127 counter accept
12-
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 counter accept
1311
add rule inet istio-ambient-nat istio-prerouting ip daddr != 127.0.0.1/32 tcp dport != 15008 mark and 0xfff != 0x539 counter redirect to :15006
14-
add rule inet istio-ambient-nat istio-prerouting ip6 daddr != ::1/128 tcp dport != 15008 mark and 0xfff != 0x539 counter redirect to :15006
1512
add rule inet istio-ambient-nat istio-output oifname != lo mark and 0xfff != 0x539 udp dport 53 counter redirect to :15053
1613
add rule inet istio-ambient-nat istio-output ip daddr != 127.0.0.1/32 tcp dport 53 mark and 0xfff != 0x539 counter redirect to :15053
17-
add rule inet istio-ambient-nat istio-output ip6 daddr != ::1/128 tcp dport 53 mark and 0xfff != 0x539 counter redirect to :15053
1814
add rule inet istio-ambient-nat istio-output meta l4proto tcp mark and 0xfff == 0x111 counter accept
1915
add rule inet istio-ambient-nat istio-output oifname lo ip daddr != 127.0.0.1/32 counter accept
20-
add rule inet istio-ambient-nat istio-output oifname lo ip6 daddr != ::1/128 counter accept
2116
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip daddr != 127.0.0.1/32 mark and 0xfff != 0x539 counter redirect to :15001
22-
add rule inet istio-ambient-nat istio-output meta l4proto tcp ip6 daddr != ::1/128 mark and 0xfff != 0x539 counter redirect to :15001
2317
add table inet istio-ambient-mangle
2418
flush table inet istio-ambient-mangle
2519
add chain inet istio-ambient-mangle prerouting { type filter hook prerouting priority -150 ; }

‎cni/pkg/nftables/testdata/hostprobe.golden‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,3 @@ add table inet istio-ambient-nat
22
flush table inet istio-ambient-nat
33
add chain inet istio-ambient-nat postrouting { type nat hook postrouting priority 100 ; }
44
add rule inet istio-ambient-nat postrouting meta l4proto tcp skuid 1000 ip daddr @istio-inpod-probes-v4 counter snat to 169.254.7.127
5-
add rule inet istio-ambient-nat postrouting meta l4proto tcp skuid 1000 ip6 daddr @istio-inpod-probes-v6 counter snat to e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164

0 commit comments

Comments
 (0)