feat(deps): update chart cilium (1.15.8 → 1.19.6)#1046
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
--- kubernetes/main/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium
+++ kubernetes/main/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium
@@ -13,13 +13,13 @@
spec:
chart: cilium
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
- version: 1.15.8
+ version: 1.19.6
install:
remediation:
retries: 3
interval: 30m
upgrade:
cleanupOnFail: true |
renovate
Bot
force-pushed
the
renovate/main-cilium-1.x
branch
from
May 18, 2026 10:57
5d0e4cb to
6926ac7
Compare
renovate
Bot
force-pushed
the
renovate/main-cilium-1.x
branch
2 times, most recently
from
June 16, 2026 16:42
9afc95e to
512cac2
Compare
renovate
Bot
changed the title
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/main-cilium-1.x
branch
from
July 17, 2026 00:00
512cac2 to
498a74e
Compare
renovate
Bot
changed the title
--- HelmRelease: kube-system/cilium ServiceAccount: kube-system/hubble-relay
+++ HelmRelease: kube-system/cilium ServiceAccount: kube-system/hubble-relay
@@ -1,7 +1,8 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: hubble-relay
namespace: kube-system
+automountServiceAccountToken: false
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-dashboard
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-dashboard
@@ -9,8456 +9,11195 @@
app.kubernetes.io/name: cilium-agent
app.kubernetes.io/part-of: cilium
grafana_dashboard: '1'
annotations:
grafana_folder: Cilium
data:
- cilium-dashboard.json: |
+ cilium-dashboard.json: |-
{
"annotations": {
"list": [
{
"builtIn": 1,
- "datasource": "-- Grafana --",
+ "datasource": {
+ "type": "datasource",
+ "uid": "grafana"
+ },
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
]
},
"description": "Dashboard for Cilium (https://cilium.io/) metrics",
"editable": true,
- "gnetId": null,
+ "fiscalYearStartMonth": 0,
"graphTooltip": 1,
- "iteration": 1606309591568,
+ "id": 1,
"links": [],
"panels": [
{
- "aliasColors": {
- "error": "#890f02",
- "warning": "#c15c17"
- },
- "bars": false,
- "dashLength": 10,
- "dashes": false,
"datasource": {
"type": "prometheus",
"uid": "${DS_PROMETHEUS}"
},
"fieldConfig": {
"defaults": {
- "custom": {}
- },
- "overrides": []
- },
- "fill": 1,
- "fillGradient": 0,
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisBorderShow": false,
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "barWidthFactor": 0.6,
+ "drawStyle": "line",
+ "fillOpacity": 10,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "insertNulls": false,
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "never",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "links": [],
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ },
+ "unit": "opm"
+ },
+ "overrides": [
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "error"
+ },
+ "properties": [
+ {
+ "id": "color",
+ "value": {
+ "fixedColor": "#890f02",
+ "mode": "fixed"
+ }
+ }
+ ]
+ },
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "warning"
+ },
+ "properties": [
+ {
+ "id": "color",
+ "value": {
+ "fixedColor": "#c15c17",
+ "mode": "fixed"
+ }
+ }
+ ]
+ }
+ ]
+ },
"gridPos": {
"h": 5,
"w": 12,
"x": 0,
"y": 0
},
- "hiddenSeries": false,
"id": 76,
- "legend": {
- "avg": false,
- "current": false,
- "max": false,
- "min": false,
- "show": true,
- "total": false,
- "values": false
- },
- "lines": true,
- "linewidth": 1,
- "links": [],
- "nullPointMode": "null",
"options": {
- "dataLinks": []
- },
- "paceLength": 10,
- "percentage": false,
- "pointradius": 5,
- "points": false,
- "renderer": "flot",
- "seriesOverrides": [
- {
- "alias": "error",
- "yaxis": 2
- }
- ],
- "spaceLength": 10,
- "stack": false,
- "steppedLine": false,
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "multi",
+ "sort": "none"
+ }
+ },
+ "pluginVersion": "11.3.1",
"targets": [
{
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
+ "editorMode": "code",
"expr": "sum(rate(cilium_errors_warnings_total{k8s_app=\"cilium\", pod=~\"$pod\"}[1m])) by (pod, level) * 60",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "{{level}}",
+ "range": true,
"refId": "A"
}
],
- "thresholds": [],
- "timeFrom": null,
- "timeRegions": [],
- "timeShift": null,
"title": "Errors & Warnings",
- "tooltip": {
- "shared": true,
- "sort": 0,
- "value_type": "individual"
- },
- "type": "graph",
- "xaxis": {
- "buckets": null,
- "mode": "time",
- "name": null,
- "show": true,
- "values": []
- },
- "yaxes": [
- {
- "format": "opm",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- },
- {
- "format": "opm",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- }
- ],
- "yaxis": {
- "align": false,
- "alignLevel": null
- }
+ "type": "timeseries"
},
{
- "aliasColors": {
- "avg": "#cffaff"
- },
- "bars": false,
- "dashLength": 10,
- "dashes": false,
"datasource": {
"type": "prometheus",
"uid": "${DS_PROMETHEUS}"
},
"fieldConfig": {
"defaults": {
- "custom": {}
- },
- "overrides": []
- },
- "fill": 0,
- "fillGradient": 0,
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisBorderShow": false,
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "barWidthFactor": 0.6,
+ "drawStyle": "line",
+ "fillOpacity": 35,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "insertNulls": false,
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "never",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "links": [],
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ },
+ "unit": "percent"
+ },
+ "overrides": [
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "avg"
+ },
+ "properties": [
+ {
+ "id": "color",
+ "value": {
+ "fixedColor": "#cffaff",
+ "mode": "fixed"
+ }
+ }
+ ]
+ },
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "max"
+ },
+ "properties": [
+ {
+ "id": "custom.fillBelowTo",
+ "value": "min"
+ },
+ {
+ "id": "custom.lineWidth",
+ "value": 0
+ }
+ ]
+ },
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "min"
[Diff truncated by flux-local]
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config
@@ -7,128 +7,178 @@
data:
identity-allocation-mode: crd
identity-heartbeat-timeout: 30m0s
identity-gc-interval: 15m0s
cilium-endpoint-gc-interval: 5m0s
nodes-gc-interval: 5m0s
- skip-cnp-status-startup-clean: 'false'
debug: 'false'
+ metrics-sampling-interval: 5m
enable-policy: default
prometheus-serve-addr: :9962
controller-group-metrics: write-cni-file sync-host-ips sync-lb-maps-with-k8s-services
proxy-prometheus-port: '9964'
operator-prometheus-serve-addr: :9963
enable-metrics: 'true'
+ enable-policy-secrets-sync: 'true'
+ policy-secrets-only-from-secrets-namespace: 'true'
+ policy-secrets-namespace: cilium-secrets
enable-ipv4: 'true'
enable-ipv6: 'false'
custom-cni-conf: 'false'
enable-bpf-clock-probe: 'false'
monitor-aggregation: medium
monitor-aggregation-interval: 5s
monitor-aggregation-flags: all
bpf-map-dynamic-size-ratio: '0.0025'
bpf-policy-map-max: '16384'
+ bpf-policy-stats-map-max: '65536'
bpf-lb-map-max: '65536'
bpf-lb-external-clusterip: 'false'
+ bpf-lb-source-range-all-types: 'false'
+ bpf-lb-algorithm-annotation: 'false'
+ bpf-lb-mode-annotation: 'false'
+ bpf-distributed-lru: 'false'
+ bpf-events-drop-enabled: 'true'
+ bpf-events-policy-verdict-enabled: 'true'
+ bpf-events-trace-enabled: 'true'
preallocate-bpf-maps: 'false'
- sidecar-istio-proxy-image: cilium/istio_proxy
cluster-name: home-ops
cluster-id: '1'
routing-mode: native
+ tunnel-protocol: vxlan
+ tunnel-source-port-range: 0-0
service-no-backend-response: reject
+ policy-deny-response: none
enable-l7-proxy: 'true'
enable-ipv4-masquerade: 'true'
enable-ipv4-big-tcp: 'false'
enable-ipv6-big-tcp: 'false'
enable-ipv6-masquerade: 'true'
+ enable-tcx: 'true'
+ datapath-mode: veth
enable-bpf-masquerade: 'false'
enable-masquerade-to-route-source: 'false'
enable-xt-socket-fallback: 'true'
install-no-conntrack-iptables-rules: 'false'
+ iptables-random-fully: 'false'
auto-direct-node-routes: 'true'
+ direct-routing-skip-unreachable: 'false'
enable-local-redirect-policy: 'true'
ipv4-native-routing-cidr: 10.40.0.0/16
+ enable-host-firewall: 'false'
devices: lan
kube-proxy-replacement: 'true'
kube-proxy-replacement-healthz-bind-address: 0.0.0.0:10256
+ enable-no-service-endpoints-routable: 'true'
bpf-lb-sock: 'false'
enable-health-check-nodeport: 'true'
enable-health-check-loadbalancer-ip: 'false'
node-port-bind-protection: 'true'
enable-auto-protect-node-port-range: 'true'
bpf-lb-mode: hybrid
bpf-lb-algorithm: maglev
bpf-lb-acceleration: disabled
- enable-svc-source-range-check: 'true'
- enable-l2-neigh-discovery: 'true'
- arping-refresh-period: 30s
+ enable-service-topology: 'false'
+ enable-l2-neigh-discovery: 'false'
+ k8s-require-ipv4-pod-cidr: 'false'
+ k8s-require-ipv6-pod-cidr: 'false'
enable-endpoint-routes: 'true'
enable-k8s-networkpolicy: 'true'
+ enable-endpoint-lockdown-on-policy-overflow: 'false'
write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
cni-exclusive: 'false'
cni-log-file: /var/run/cilium/cilium-cni.log
enable-endpoint-health-checking: 'true'
enable-health-checking: 'true'
+ health-check-icmp-failure-threshold: '3'
enable-well-known-identities: 'false'
- enable-remote-node-identity: 'true'
+ enable-node-selector-labels: 'false'
synchronize-k8s-nodes: 'true'
operator-api-serve-addr: 127.0.0.1:9234
enable-hubble: 'true'
hubble-socket-path: /var/run/cilium/hubble.sock
hubble-metrics-server: :9965
+ hubble-metrics-server-enable-tls: 'false'
+ enable-hubble-open-metrics: 'false'
hubble-metrics: dns:query drop tcp flow port-distribution icmp http
- enable-hubble-open-metrics: 'false'
- hubble-export-file-max-size-mb: '10'
- hubble-export-file-max-backups: '5'
+ hubble-network-policy-correlation-enabled: 'true'
hubble-listen-address: :4244
hubble-disable-tls: 'false'
hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
ipam: kubernetes
ipam-cilium-node-update-rate: 15s
+ default-lb-service-ipam: lbipam
egress-gateway-reconciliation-trigger-interval: 1s
enable-vtep: 'false'
vtep-endpoint: ''
vtep-cidr: ''
vtep-mask: ''
vtep-mac: ''
enable-l2-announcements: 'true'
l2-announcements-lease-duration: 300s
l2-announcements-renew-deadline: 60s
l2-announcements-retry-period: 10s
enable-bgp-control-plane: 'true'
bgp-secrets-namespace: kube-system
+ enable-bgp-control-plane-status-report: 'true'
+ bgp-router-id-allocation-mode: default
+ bgp-router-id-allocation-ip-pool: ''
+ enable-bgp-legacy-origin-attribute: 'false'
+ packetization-layer-pmtud-mode: blackhole
procfs: /host/proc
bpf-root: /sys/fs/bpf
cgroup-root: /sys/fs/cgroup
vlan-bpf-bypass: '0'
- enable-k8s-terminating-endpoint: 'true'
+ identity-management-mode: agent
enable-sctp: 'false'
- k8s-client-qps: '10'
- k8s-client-burst: '20'
remove-cilium-node-taints: 'true'
set-cilium-node-taints: 'true'
set-cilium-is-up-condition: 'true'
- unmanaged-pod-watcher-interval: '15'
+ unmanaged-pod-watcher-interval: 15s
dnsproxy-enable-transparent-mode: 'true'
dnsproxy-socket-linger-timeout: '10'
tofqdns-dns-reject-response-code: refused
tofqdns-enable-dns-compression: 'true'
- tofqdns-endpoint-max-ip-per-hostname: '50'
+ tofqdns-endpoint-max-ip-per-hostname: '1000'
tofqdns-idle-connection-grace-period: 0s
tofqdns-max-deferred-connection-deletes: '10000'
tofqdns-proxy-response-max-delay: 100ms
+ tofqdns-preallocate-identities: 'true'
agent-not-ready-taint-key: node.cilium.io/agent-not-ready
- mesh-auth-enabled: 'true'
+ mesh-auth-enabled: 'false'
mesh-auth-queue-size: '1024'
mesh-auth-rotated-identities-queue-size: '1024'
mesh-auth-gc-interval: 5m0s
proxy-xff-num-trusted-hops-ingress: '0'
proxy-xff-num-trusted-hops-egress: '0'
proxy-connect-timeout: '2'
+ proxy-initial-fetch-timeout: '30'
+ proxy-max-active-downstream-connections: '50000'
proxy-max-requests-per-connection: '0'
proxy-max-connection-duration-seconds: '0'
proxy-idle-timeout-seconds: '60'
+ proxy-max-concurrent-retries: '128'
+ proxy-use-original-source-address: 'true'
+ proxy-cluster-max-connections: '1024'
+ proxy-cluster-max-requests: '1024'
+ http-retry-count: '3'
+ http-stream-idle-timeout: '300'
external-envoy-proxy: 'false'
+ envoy-base-id: '0'
+ envoy-access-log-buffer-size: '4096'
+ envoy-keep-cap-netbindservice: 'false'
max-connected-clusters: '255'
+ clustermesh-cache-ttl: 0s
+ clustermesh-enable-endpoint-sync: 'false'
+ clustermesh-enable-mcs-api: 'false'
+ clustermesh-mcs-api-install-crds: 'true'
+ policy-default-local-cluster: 'true'
+ nat-map-stats-entries: '32'
+ nat-map-stats-interval: 30s
+ enable-lb-ipam: 'true'
+ enable-non-default-deny-policies: 'true'
+ enable-source-ip-verification: 'true'
+ enable-dynamic-config: 'true'
+ enable-drift-checker: 'true'
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-operator-dashboard
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-operator-dashboard
@@ -11,17 +11,30 @@
grafana_dashboard: '1'
annotations:
grafana_folder: Cilium
data:
cilium-operator-dashboard.json: |
{
+ "__inputs": [
+ {
+ "name": "DS_PROMETHEUS",
+ "label": "prometheus",
+ "description": "",
+ "type": "datasource",
+ "pluginId": "prometheus",
+ "pluginName": "Prometheus"
+ }
+ ],
"annotations": {
"list": [
{
"builtIn": 1,
- "datasource": "-- Grafana --",
+ "datasource": {
+ "type": "datasource",
+ "uid": "grafana"
+ },
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
@@ -37,13 +50,16 @@
"aliasColors": {
"avg": "#cffaff"
},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -163,13 +179,16 @@
"aliasColors": {
"MAX_resident_memory_bytes_max": "#e5ac0e"
},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -293,13 +312,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -390,13 +412,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -487,13 +512,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -584,13 +612,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -681,13 +712,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -778,13 +812,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -875,13 +912,16 @@
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
- "datasource": "prometheus",
+ "datasource": {
+ "type": "prometheus",
+ "uid": "${DS_PROMETHEUS}"
+ },
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
@@ -973,13 +1013,19 @@
],
"refresh": false,
"schemaVersion": 25,
"style": "dark",
"tags": [],
"templating": {
- "list": []
+ "list": [
+ {
+ "type": "datasource",
+ "name": "DS_PROMETHEUS",
+ "query": "prometheus"
+ }
+ ]
},
"time": {
"from": "now-30m",
"to": "now"
},
"timepicker": {
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-relay-config
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-relay-config
@@ -2,13 +2,12 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: hubble-relay-config
namespace: kube-system
data:
- config.yaml: "cluster-name: home-ops\npeer-service: \"hubble-peer.kube-system.svc.cluster.local:443\"\
- \nlisten-address: :4245\ngops: true\ngops-port: \"9893\"\ndial-timeout: \nretry-timeout:\
- \ \nsort-buffer-len-max: \nsort-buffer-drain-timeout: \ntls-hubble-client-cert-file:\
- \ /var/lib/hubble-relay/tls/client.crt\ntls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\n\
- tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\ndisable-server-tls:\
- \ true\n"
+ config.yaml: "cluster-name: home-ops\npeer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\
+ \nlisten-address: :4245\ngops: true\ngops-port: \"9893\"\nretry-timeout: \nsort-buffer-len-max:\
+ \ \nsort-buffer-drain-timeout: \ntls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\n\
+ tls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\ntls-hubble-server-ca-files:\
+ \ /var/lib/hubble-relay/tls/hubble-server-ca.crt\n\ndisable-server-tls: true\n"
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-ui-nginx
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-ui-nginx
@@ -2,23 +2,39 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: hubble-ui-nginx
namespace: kube-system
data:
- nginx.conf: "server {\n listen 8081;\n listen [::]:8081;\n \
- \ server_name localhost;\n root /app;\n index index.html;\n client_max_body_size\
- \ 1G;\n\n location / {\n proxy_set_header Host $host;\n proxy_set_header\
- \ X-Real-IP $remote_addr;\n\n # CORS\n add_header Access-Control-Allow-Methods\
- \ \"GET, POST, PUT, HEAD, DELETE, OPTIONS\";\n add_header Access-Control-Allow-Origin\
- \ *;\n add_header Access-Control-Max-Age 1728000;\n add_header Access-Control-Expose-Headers\
- \ content-length,grpc-status,grpc-message;\n add_header Access-Control-Allow-Headers\
- \ range,keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout;\n\
- \ if ($request_method = OPTIONS) {\n return 204;\n }\n\
- \ # /CORS\n\n location /api {\n proxy_http_version 1.1;\n\
- \ proxy_pass_request_headers on;\n proxy_hide_header Access-Control-Allow-Origin;\n\
- \ proxy_pass http://127.0.0.1:8090;\n }\n location /\
- \ {\n # double `/index.html` is required here \n try_files\
- \ $uri $uri/ /index.html /index.html;\n }\n\n # Liveness probe\n\
- \ location /healthz {\n access_log off;\n add_header\
- \ Content-Type text/plain;\n return 200 'ok';\n }\n }\n}"
+ nginx.conf: |-
+ server {
+ listen 8081;
+ listen [::]:8081;
+ server_name localhost;
+ root /app;
+ index index.html;
+ client_max_body_size 1G;
+ location / {
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+
+ location /api {
+ proxy_http_version 1.1;
+ proxy_pass_request_headers on;
+ proxy_pass http://127.0.0.1:8090;
+ }
+ location / {
+ if ($http_user_agent ~* "kube-probe") { access_log off; }
+ # double `/index.html` is required here
+ try_files $uri $uri/ /index.html /index.html;
+ }
+
+ # Liveness probe
+ location /healthz {
+ access_log off;
+ add_header Content-Type text/plain;
+ return 200 'ok';
+ }
+ }
+ }
+
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-dashboard
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-dashboard
@@ -9,3256 +9,1059 @@
app.kubernetes.io/name: hubble
app.kubernetes.io/part-of: cilium
grafana_dashboard: '1'
annotations:
grafana_folder: Cilium
data:
- hubble-dashboard.json: |
- {
- "annotations": {
- "list": [
- {
- "builtIn": 1,
- "datasource": "-- Grafana --",
- "enable": true,
- "hide": true,
- "iconColor": "rgba(0, 211, 255, 1)",
- "name": "Annotations & Alerts",
- "type": "dashboard"
- }
- ]
- },
- "editable": true,
- "gnetId": null,
- "graphTooltip": 0,
- "id": 3,
- "links": [],
- "panels": [
- {
- "collapsed": false,
- "gridPos": {
- "h": 1,
- "w": 24,
- "x": 0,
- "y": 0
- },
- "id": 14,
- "panels": [],
- "title": "General Processing",
- "type": "row"
- },
- {
- "aliasColors": {},
- "bars": false,
- "dashLength": 10,
- "dashes": false,
- "datasource": "prometheus",
- "fill": 1,
- "gridPos": {
- "h": 5,
- "w": 12,
- "x": 0,
- "y": 1
- },
- "id": 12,
- "legend": {
- "avg": false,
- "current": false,
- "max": false,
- "min": false,
- "show": true,
- "total": false,
- "values": false
- },
- "lines": true,
- "linewidth": 1,
- "links": [],
- "nullPointMode": "null",
- "options": {},
- "percentage": false,
- "pointradius": 2,
- "points": false,
- "renderer": "flot",
- "seriesOverrides": [
- {
- "alias": "max",
- "fillBelowTo": "avg",
- "lines": false
- },
- {
- "alias": "avg",
- "fill": 0,
- "fillBelowTo": "min"
- },
- {
- "alias": "min",
- "lines": false
- }
- ],
- "spaceLength": 10,
- "stack": false,
- "steppedLine": false,
- "targets": [
- {
- "expr": "avg(sum(rate(hubble_flows_processed_total[1m])) by (pod))",
- "format": "time_series",
- "intervalFactor": 1,
- "legendFormat": "avg",
- "refId": "A"
- },
- {
- "expr": "min(sum(rate(hubble_flows_processed_total[1m])) by (pod))",
- "format": "time_series",
- "intervalFactor": 1,
- "legendFormat": "min",
- "refId": "B"
- },
- {
- "expr": "max(sum(rate(hubble_flows_processed_total[1m])) by (pod))",
- "format": "time_series",
- "intervalFactor": 1,
- "legendFormat": "max",
- "refId": "C"
- }
- ],
- "thresholds": [],
- "timeFrom": null,
- "timeRegions": [],
- "timeShift": null,
- "title": "Flows processed Per Node",
- "tooltip": {
- "shared": true,
- "sort": 1,
- "value_type": "individual"
- },
- "type": "graph",
- "xaxis": {
- "buckets": null,
- "mode": "time",
- "name": null,
- "show": true,
- "values": []
- },
- "yaxes": [
- {
- "format": "ops",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- },
- {
- "format": "short",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- }
- ],
- "yaxis": {
- "align": false,
- "alignLevel": null
- }
- },
- {
- "aliasColors": {},
- "bars": false,
- "dashLength": 10,
- "dashes": false,
- "datasource": "prometheus",
- "fill": 1,
- "gridPos": {
- "h": 5,
- "w": 12,
- "x": 12,
- "y": 1
- },
- "id": 32,
- "legend": {
- "avg": false,
- "current": false,
- "max": false,
- "min": false,
- "show": true,
- "total": false,
- "values": false
- },
- "lines": true,
- "linewidth": 1,
- "links": [],
- "nullPointMode": "null",
- "options": {},
- "percentage": false,
- "pointradius": 2,
- "points": false,
- "renderer": "flot",
- "seriesOverrides": [],
- "spaceLength": 10,
- "stack": true,
- "steppedLine": false,
- "targets": [
- {
- "expr": "sum(rate(hubble_flows_processed_total[1m])) by (pod, type)",
- "format": "time_series",
- "intervalFactor": 1,
- "legendFormat": "{{type}}",
- "refId": "A"
- }
- ],
- "thresholds": [],
- "timeFrom": null,
- "timeRegions": [],
- "timeShift": null,
- "title": "Flows Types",
- "tooltip": {
- "shared": true,
- "sort": 2,
- "value_type": "individual"
- },
- "type": "graph",
- "xaxis": {
- "buckets": null,
- "mode": "time",
- "name": null,
- "show": true,
- "values": []
- },
- "yaxes": [
- {
- "format": "ops",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- },
- {
- "format": "short",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- }
- ],
- "yaxis": {
- "align": false,
- "alignLevel": null
- }
- },
- {
- "aliasColors": {},
- "bars": false,
- "dashLength": 10,
- "dashes": false,
- "datasource": "prometheus",
- "fill": 1,
- "gridPos": {
- "h": 5,
- "w": 12,
- "x": 0,
- "y": 6
- },
- "id": 59,
- "legend": {
- "avg": false,
- "current": false,
- "max": false,
- "min": false,
- "show": true,
- "total": false,
- "values": false
- },
- "lines": true,
- "linewidth": 1,
- "links": [],
- "nullPointMode": "null",
- "options": {},
- "percentage": false,
- "pointradius": 2,
- "points": false,
- "renderer": "flot",
- "seriesOverrides": [],
- "spaceLength": 10,
- "stack": true,
- "steppedLine": false,
- "targets": [
- {
- "expr": "sum(rate(hubble_flows_processed_total{type=\"L7\"}[1m])) by (pod, subtype)",
- "format": "time_series",
- "intervalFactor": 1,
- "legendFormat": "{{subtype}}",
- "refId": "A"
- }
- ],
- "thresholds": [],
- "timeFrom": null,
- "timeRegions": [],
- "timeShift": null,
- "title": "L7 Flow Distribution",
- "tooltip": {
- "shared": true,
- "sort": 2,
- "value_type": "individual"
- },
- "type": "graph",
- "xaxis": {
- "buckets": null,
- "mode": "time",
- "name": null,
- "show": true,
- "values": []
- },
- "yaxes": [
- {
- "format": "ops",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- },
- {
- "format": "short",
- "label": null,
- "logBase": 1,
- "max": null,
- "min": null,
- "show": true
- }
- ],
- "yaxis": {
- "align": false,
- "alignLevel": null
- }
- },
- {
- "aliasColors": {},
- "bars": false,
- "dashLength": 10,
- "dashes": false,
- "datasource": "prometheus",
- "fill": 1,
- "gridPos": {
- "h": 5,
- "w": 12,
- "x": 12,
- "y": 6
- },
- "id": 60,
- "legend": {
- "avg": false,
- "current": false,
- "max": false,
- "min": false,
- "show": true,
- "total": false,
- "values": false
- },
- "lines": true,
- "linewidth": 1,
- "links": [],
- "nullPointMode": "null",
- "options": {},
- "percentage": false,
- "pointradius": 2,
- "points": false,
- "renderer": "flot",
- "seriesOverrides": [],
- "spaceLength": 10,
- "stack": true,
- "steppedLine": false,
- "targets": [
- {
- "expr": "sum(rate(hubble_flows_processed_total{type=\"Trace\"}[1m])) by (pod, subtype)",
- "format": "time_series",
- "intervalFactor": 1,
- "legendFormat": "{{subtype}}",
- "refId": "A"
- }
- ],
- "thresholds": [],
- "timeFrom": null,
- "timeRegions": [],
- "timeShift": null,
- "title": "Trace Flow Distribution",
- "tooltip": {
[Diff truncated by flux-local]
--- HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-l7-http-metrics-by-workload
+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/hubble-l7-http-metrics-by-workload
@@ -11,13 +11,22 @@
grafana_dashboard: '1'
annotations:
grafana_folder: Cilium
data:
hubble-l7-http-metrics-by-workload.json: |
{
- "__inputs": [],
+ "__inputs": [
+ {
+ "name": "DS_PROMETHEUS",
+ "label": "prometheus",
+ "description": "",
+ "type": "datasource",
+ "pluginId": "prometheus",
+ "pluginName": "Prometheus"
+ }
+ ],
"__elements": {},
"__requires": [
{
"type": "grafana",
"id": "grafana",
"name": "Grafana",
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium
+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium
@@ -106,14 +106,12 @@
verbs:
- get
- update
- apiGroups:
- cilium.io
resources:
- - ciliumnetworkpolicies/status
- - ciliumclusterwidenetworkpolicies/status
- ciliumendpoints/status
- ciliumendpoints
- ciliuml2announcementpolicies/status
- ciliumbgpnodeconfigs/status
verbs:
- patch
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium-operator
+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/cilium-operator
@@ -15,12 +15,20 @@
- list
- watch
- delete
- apiGroups:
- ''
resources:
+ - configmaps
+ resourceNames:
+ - cilium-config
+ verbs:
+ - patch
+- apiGroups:
+ - ''
+ resources:
- nodes
verbs:
- list
- watch
- apiGroups:
- ''
@@ -45,12 +53,13 @@
- update
- patch
- apiGroups:
- ''
resources:
- namespaces
+ - secrets
verbs:
- get
- list
- watch
- apiGroups:
- ''
@@ -128,12 +137,19 @@
- get
- list
- watch
- delete
- patch
- apiGroups:
+ - cilium.io
+ resources:
+ - ciliumbgpclusterconfigs/status
+ - ciliumbgppeerconfigs/status
+ verbs:
+ - update
+- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- create
- get
@@ -144,40 +160,41 @@
resources:
- customresourcedefinitions
verbs:
- update
resourceNames:
- ciliumloadbalancerippools.cilium.io
- - ciliumbgppeeringpolicies.cilium.io
- ciliumbgpclusterconfigs.cilium.io
- ciliumbgppeerconfigs.cilium.io
- ciliumbgpadvertisements.cilium.io
- ciliumbgpnodeconfigs.cilium.io
- ciliumbgpnodeconfigoverrides.cilium.io
- ciliumclusterwideenvoyconfigs.cilium.io
- ciliumclusterwidenetworkpolicies.cilium.io
- ciliumegressgatewaypolicies.cilium.io
- ciliumendpoints.cilium.io
- ciliumendpointslices.cilium.io
- ciliumenvoyconfigs.cilium.io
- - ciliumexternalworkloads.cilium.io
- ciliumidentities.cilium.io
- ciliumlocalredirectpolicies.cilium.io
- ciliumnetworkpolicies.cilium.io
- ciliumnodes.cilium.io
- ciliumnodeconfigs.cilium.io
- ciliumcidrgroups.cilium.io
- ciliuml2announcementpolicies.cilium.io
- ciliumpodippools.cilium.io
+ - ciliumgatewayclassconfigs.cilium.io
- apiGroups:
- cilium.io
resources:
- ciliumloadbalancerippools
- ciliumpodippools
+ - ciliumbgppeeringpolicies
- ciliumbgpclusterconfigs
- ciliumbgpnodeconfigoverrides
+ - ciliumbgppeerconfigs
verbs:
- get
- list
- watch
- apiGroups:
- cilium.io
@@ -196,7 +213,13 @@
resources:
- leases
verbs:
- create
- get
- update
+- apiGroups:
+ - cilium.io
+ resources:
+ - ciliumendpointslices
+ verbs:
+ - deletecollection
--- HelmRelease: kube-system/cilium ClusterRole: kube-system/hubble-ui
+++ HelmRelease: kube-system/cilium ClusterRole: kube-system/hubble-ui
@@ -3,20 +3,12 @@
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: hubble-ui
labels:
app.kubernetes.io/part-of: cilium
rules:
-- apiGroups:
- - networking.k8s.io
- resources:
- - networkpolicies
- verbs:
- - get
- - list
- - watch
- apiGroups:
- ''
resources:
- componentstatuses
- endpoints
- namespaces
@@ -32,15 +24,7 @@
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
-- apiGroups:
- - cilium.io
- resources:
- - '*'
- verbs:
- - get
- - list
- - watch
--- HelmRelease: kube-system/cilium Service: kube-system/hubble-relay
+++ HelmRelease: kube-system/cilium Service: kube-system/hubble-relay
@@ -12,8 +12,8 @@
type: ClusterIP
selector:
k8s-app: hubble-relay
ports:
- protocol: TCP
port: 80
- targetPort: 4245
+ targetPort: grpc
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium
+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium
@@ -16,60 +16,65 @@
rollingUpdate:
maxUnavailable: 2
type: RollingUpdate
template:
metadata:
annotations:
- cilium.io/cilium-configmap-checksum: bc60cf9435462f7dead54974886510fcb5a6735223dbbca6b9a1a6bc73e43ad1
+ cilium.io/cilium-configmap-checksum: 4ec796c83c9e3f154eaea1a8847c4aa7d263d2dddd9f6b4581a1b1f8d0990565
+ kubectl.kubernetes.io/default-container: cilium-agent
labels:
k8s-app: cilium
app.kubernetes.io/name: cilium-agent
app.kubernetes.io/part-of: cilium
spec:
securityContext:
appArmorProfile:
type: Unconfined
+ seccompProfile:
+ type: Unconfined
containers:
- name: cilium-agent
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
command:
- cilium-agent
args:
- --config-dir=/tmp/cilium/config-map
startupProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9879
+ port: health
scheme: HTTP
httpHeaders:
- name: brief
value: 'true'
- failureThreshold: 105
+ failureThreshold: 300
periodSeconds: 2
successThreshold: 1
initialDelaySeconds: 5
livenessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9879
+ port: health
scheme: HTTP
httpHeaders:
- name: brief
value: 'true'
+ - name: require-k8s-connectivity
+ value: 'false'
periodSeconds: 30
successThreshold: 1
failureThreshold: 10
timeoutSeconds: 5
readinessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9879
+ port: health
scheme: HTTP
httpHeaders:
- name: brief
value: 'true'
periodSeconds: 30
successThreshold: 1
@@ -94,12 +99,16 @@
resource: limits.memory
divisor: '1'
- name: KUBERNETES_SERVICE_HOST
value: 127.0.0.1
- name: KUBERNETES_SERVICE_PORT
value: '6444'
+ - name: KUBE_CLIENT_BACKOFF_BASE
+ value: '1'
+ - name: KUBE_CLIENT_BACKOFF_DURATION
+ value: '120'
lifecycle:
postStart:
exec:
command:
- bash
- -c
@@ -125,12 +134,16 @@
echo 'Done!'
preStop:
exec:
command:
- /cni-uninstall.sh
ports:
+ - name: health
+ containerPort: 9879
+ hostPort: 9879
+ protocol: TCP
- name: peer-service
containerPort: 4244
hostPort: 4244
protocol: TCP
- name: prometheus
containerPort: 9962
@@ -173,12 +186,15 @@
mountPath: /sys/fs/bpf
mountPropagation: HostToContainer
- name: cilium-cgroup
mountPath: /sys/fs/cgroup
- name: cilium-run
mountPath: /var/run/cilium
+ - name: cilium-netns
+ mountPath: /var/run/cilium/netns
+ mountPropagation: HostToContainer
- name: etc-cni-netd
mountPath: /host/etc/cni/net.d
- name: clustermesh-secrets
mountPath: /var/lib/cilium/clustermesh
readOnly: true
- name: lib-modules
@@ -190,13 +206,13 @@
mountPath: /var/lib/cilium/tls/hubble
readOnly: true
- name: tmp
mountPath: /tmp
initContainers:
- name: config
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
command:
- cilium-dbg
- build-config
env:
- name: K8S_NODE_NAME
@@ -214,22 +230,28 @@
- name: KUBERNETES_SERVICE_PORT
value: '6444'
volumeMounts:
- name: tmp
mountPath: /tmp
terminationMessagePolicy: FallbackToLogsOnError
+ securityContext:
+ capabilities:
+ add:
+ - NET_ADMIN
+ drop:
+ - ALL
- name: mount-cgroup
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
env:
- name: CGROUP_ROOT
value: /sys/fs/cgroup
- name: BIN_PATH
value: /var/lib/rancher/k3s/data/cni
command:
- - sh
+ - bash
- -ec
- |
cp /usr/bin/cilium-mount /hostbin/cilium-mount;
nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT;
rm /hostbin/cilium-mount
volumeMounts:
@@ -247,19 +269,19 @@
- SYS_ADMIN
- SYS_CHROOT
- SYS_PTRACE
drop:
- ALL
- name: apply-sysctl-overwrites
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
env:
- name: BIN_PATH
value: /var/lib/rancher/k3s/data/cni
command:
- - sh
+ - bash
- -ec
- |
cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
rm /hostbin/cilium-sysctlfix
volumeMounts:
@@ -277,13 +299,13 @@
- SYS_ADMIN
- SYS_CHROOT
- SYS_PTRACE
drop:
- ALL
- name: mount-bpf-fs
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
args:
- mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
command:
- /bin/bash
- -c
@@ -293,13 +315,13 @@
privileged: true
volumeMounts:
- name: bpf-maps
mountPath: /sys/fs/bpf
mountPropagation: Bidirectional
- name: clean-cilium-state
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
command:
- /init-container.sh
env:
- name: CILIUM_ALL_STATE
valueFrom:
@@ -341,17 +363,20 @@
- name: cilium-cgroup
mountPath: /sys/fs/cgroup
mountPropagation: HostToContainer
- name: cilium-run
mountPath: /var/run/cilium
- name: install-cni-binaries
- image: quay.io/cilium/cilium:v1.15.8@sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7
+ image: quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92
imagePullPolicy: IfNotPresent
command:
- /install-plugin.sh
resources:
+ limits:
+ cpu: 1
+ memory: 1Gi
requests:
cpu: 100m
memory: 10Mi
securityContext:
seLinuxOptions:
level: s0
@@ -384,12 +409,16 @@
- name: tmp
emptyDir: {}
- name: cilium-run
hostPath:
path: /var/run/cilium
type: DirectoryOrCreate
+ - name: cilium-netns
+ hostPath:
+ path: /var/run/netns
+ type: DirectoryOrCreate
- name: bpf-maps
hostPath:
path: /sys/fs/bpf
type: DirectoryOrCreate
- name: hostproc
hostPath:
@@ -428,12 +457,22 @@
- key: tls.key
path: common-etcd-client.key
- key: tls.crt
path: common-etcd-client.crt
- key: ca.crt
path: common-etcd-client-ca.crt
+ - secret:
+ name: clustermesh-apiserver-local-cert
+ optional: true
+ items:
+ - key: tls.key
+ path: local-etcd-client.key
+ - key: tls.crt
+ path: local-etcd-client.crt
+ - key: ca.crt
+ path: local-etcd-client-ca.crt
- name: host-proc-sys-net
hostPath:
path: /proc/sys/net
type: Directory
- name: host-proc-sys-kernel
hostPath:
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator
+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator
@@ -20,22 +20,25 @@
maxSurge: 25%
maxUnavailable: 100%
type: RollingUpdate
template:
metadata:
annotations:
- cilium.io/cilium-configmap-checksum: bc60cf9435462f7dead54974886510fcb5a6735223dbbca6b9a1a6bc73e43ad1
+ cilium.io/cilium-configmap-checksum: 4ec796c83c9e3f154eaea1a8847c4aa7d263d2dddd9f6b4581a1b1f8d0990565
labels:
io.cilium/app: operator
name: cilium-operator
app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: cilium-operator
spec:
+ securityContext:
+ seccompProfile:
+ type: RuntimeDefault
containers:
- name: cilium-operator
- image: quay.io/cilium/operator-generic:v1.15.8@sha256:e77ae6fc8a978f98363cf74d3c883dfaa6454c6e23ec417a60952f29408e2f18
+ image: quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665
imagePullPolicy: IfNotPresent
command:
- cilium-operator-generic
args:
- --config-dir=/tmp/cilium/config-map
- --debug=$(CILIUM_DEBUG)
@@ -58,39 +61,47 @@
optional: true
- name: KUBERNETES_SERVICE_HOST
value: 127.0.0.1
- name: KUBERNETES_SERVICE_PORT
value: '6444'
ports:
+ - name: health
+ containerPort: 9234
+ hostPort: 9234
- name: prometheus
containerPort: 9963
hostPort: 9963
protocol: TCP
livenessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9234
+ port: health
scheme: HTTP
initialDelaySeconds: 60
periodSeconds: 10
timeoutSeconds: 3
readinessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
- port: 9234
+ port: health
scheme: HTTP
initialDelaySeconds: 0
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 5
volumeMounts:
- name: cilium-config-path
mountPath: /tmp/cilium/config-map
readOnly: true
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
terminationMessagePolicy: FallbackToLogsOnError
hostNetwork: true
restartPolicy: Always
priorityClassName: system-cluster-critical
serviceAccountName: cilium-operator
automountServiceAccountToken: true
@@ -101,12 +112,21 @@
matchLabels:
io.cilium/app: operator
topologyKey: kubernetes.io/hostname
nodeSelector:
kubernetes.io/os: linux
tolerations:
- - operator: Exists
+ - key: node-role.kubernetes.io/control-plane
+ operator: Exists
+ - key: node-role.kubernetes.io/master
+ operator: Exists
+ - key: node.kubernetes.io/not-ready
+ operator: Exists
+ - key: node.cloudprovider.kubernetes.io/uninitialized
+ operator: Exists
+ - key: node.cilium.io/agent-not-ready
+ operator: Exists
volumes:
- name: cilium-config-path
configMap:
name: cilium-config
--- HelmRelease: kube-system/cilium Deployment: kube-system/hubble-relay
+++ HelmRelease: kube-system/cilium Deployment: kube-system/hubble-relay
@@ -17,30 +17,35 @@
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
annotations:
- cilium.io/hubble-relay-configmap-checksum: 95a07050a436b500309d863d55d0507f1bfc2906d47c8dab4ea91f08a1753f49
+ cilium.io/hubble-relay-configmap-checksum: af9aa411f2aee17a2e9d6232e9bd261919cc3b66ee6c36a70ac58022af9bf213
labels:
k8s-app: hubble-relay
app.kubernetes.io/name: hubble-relay
app.kubernetes.io/part-of: cilium
spec:
securityContext:
fsGroup: 65532
+ seccompProfile:
+ type: RuntimeDefault
containers:
- name: hubble-relay
securityContext:
+ allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
- image: quay.io/cilium/hubble-relay:v1.15.8@sha256:47e8a19f60d0d226ec3d2c675ec63908f1f2fb936a39897f2e3255b3bab01ad6
+ seccompProfile:
+ type: RuntimeDefault
+ image: quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44
imagePullPolicy: IfNotPresent
command:
- hubble-relay
args:
- serve
ports:
--- HelmRelease: kube-system/cilium Deployment: kube-system/hubble-ui
+++ HelmRelease: kube-system/cilium Deployment: kube-system/hubble-ui
@@ -17,13 +17,13 @@
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
annotations:
- cilium.io/hubble-ui-nginx-configmap-checksum: e8acee96ed990156efd0291c8c33709d2c7902d2ec993eefa16c7cd3d1a9d84b
+ cilium.io/hubble-ui-nginx-configmap-checksum: 76283720d1bb70050debf51116121fa9a67ebc9d1cd9167c3dd9bdbfb613df37
labels:
k8s-app: hubble-ui
app.kubernetes.io/name: hubble-ui
app.kubernetes.io/part-of: cilium
spec:
securityContext:
@@ -32,49 +32,53 @@
runAsUser: 1001
priorityClassName: null
serviceAccountName: hubble-ui
automountServiceAccountToken: true
containers:
- name: frontend
- image: quay.io/cilium/hubble-ui:v0.13.1@sha256:e2e9313eb7caf64b0061d9da0efbdad59c6c461f6ca1752768942bfeda0796c6
+ image: quay.io/cilium/hubble-ui:v0.13.5@sha256:f7d514fc54d784ed6df9d58cf0e97648b143f92b766dd1780ed3fc845bd4c516
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 8081
livenessProbe:
httpGet:
path: /healthz
- port: 8081
+ port: http
readinessProbe:
httpGet:
path: /
- port: 8081
+ port: http
volumeMounts:
- name: hubble-ui-nginx-conf
mountPath: /etc/nginx/conf.d/default.conf
subPath: nginx.conf
- name: tmp-dir
mountPath: /tmp
terminationMessagePolicy: FallbackToLogsOnError
+ securityContext:
+ allowPrivilegeEscalation: false
- name: backend
- image: quay.io/cilium/hubble-ui-backend:v0.13.1@sha256:0e0eed917653441fded4e7cdb096b7be6a3bddded5a2dd10812a27b1fc6ed95b
+ image: quay.io/cilium/hubble-ui-backend:v0.13.5@sha256:fac0c300ae119274edca11fd89b1ad23c788792d8bc4ea2ba631c709e8d3c688
imagePullPolicy: IfNotPresent
env:
- name: EVENTS_SERVER_PORT
value: '8090'
- name: FLOWS_API_ADDR
value: hubble-relay:80
ports:
- name: grpc
containerPort: 8090
volumeMounts: null
terminationMessagePolicy: FallbackToLogsOnError
+ securityContext:
+ allowPrivilegeEscalation: false
nodeSelector:
kubernetes.io/os: linux
volumes:
- configMap:
defaultMode: 420
name: hubble-ui-nginx
name: hubble-ui-nginx-conf
- - emptyDir: {}
- name: tmp-dir
+ - name: tmp-dir
+ emptyDir: {}
--- HelmRelease: kube-system/cilium ServiceMonitor: kube-system/cilium-agent
+++ HelmRelease: kube-system/cilium ServiceMonitor: kube-system/cilium-agent
@@ -3,26 +3,28 @@
kind: ServiceMonitor
metadata:
name: cilium-agent
namespace: kube-system
labels:
app.kubernetes.io/part-of: cilium
+ app.kubernetes.io/name: cilium-agent
spec:
selector:
matchLabels:
- k8s-app: cilium
+ app.kubernetes.io/name: cilium-agent
namespaceSelector:
matchNames:
- kube-system
endpoints:
- port: metrics
interval: 10s
honorLabels: true
path: /metrics
relabelings:
- - replacement: ${1}
+ - action: replace
+ replacement: ${1}
sourceLabels:
- __meta_kubernetes_pod_node_name
targetLabel: node
targetLabels:
- k8s-app
--- HelmRelease: kube-system/cilium ServiceMonitor: kube-system/hubble
+++ HelmRelease: kube-system/cilium ServiceMonitor: kube-system/hubble
@@ -3,24 +3,27 @@
kind: ServiceMonitor
metadata:
name: hubble
namespace: kube-system
labels:
app.kubernetes.io/part-of: cilium
+ $$ This message was truncated. Download full message |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.15.8→1.19.6Release Notes
cilium/cilium (cilium)
v1.19.6: 1.19.6Compare Source
Summary of Changes
Minor Changes:
spec.telemetry.accessLogsfield in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev)Bugfixes:
cilium_operator_unmanaged_podsgauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #46975, Upstream PR #46668, @Suyash1700)service.cilium.io/affinity: "none"incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #46691, Upstream PR #46635, @mkamadeus)CI Changes:
Misc Changes:
00feed3(v1.19) (#46657, @cilium-renovate[bot])be93311(v1.19) (#46907, @cilium-renovate[bot])cf1189d(v1.19) (#47115, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.6@​sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.6@​sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6docker-plugin
quay.io/cilium/docker-plugin:v1.19.6@​sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9echubble-relay
quay.io/cilium/hubble-relay:v1.19.6@​sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.6@​sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efafoperator-aws
quay.io/cilium/operator-aws:v1.19.6@​sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3operator-azure
quay.io/cilium/operator-azure:v1.19.6@​sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adeddoperator-generic
quay.io/cilium/operator-generic:v1.19.6@​sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665operator
quay.io/cilium/operator:v1.19.6@​sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90v1.19.5: 1.19.5Compare Source
Summary of Changes
Minor Changes:
Bugfixes:
nodeSelectorLabelsis enabled to fix CiliumNetworkPolicy withfromNodes/toNodeswithpolicy-default-local-clusterenabled (enabled by default in 1.19+) (Backport PR #46170, Upstream PR #46068, @MrFreezeex)CI Changes:
pull_requesttriggered workflows to ariane (Backport PR #46452, Upstream PR #45363, @nebril)Misc Changes:
0fc1dd3(v1.19) (#46153, @cilium-renovate[bot])11ecd4e(v1.19) (#46277, @cilium-renovate[bot])cd47774(v1.19) (#46137, @cilium-renovate[bot])e1b3ec8(v1.19) (#46007, @cilium-renovate[bot])9532d8c(v1.19) (#46535, @cilium-renovate[bot])cd05a37(v1.19) (#46138, @cilium-renovate[bot])379065f(v1.19) (#46536, @cilium-renovate[bot])ff6756f(v1.19) (#45996, @cilium-renovate[bot])l2podAnnouncements.interfaceHelm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must usel2podAnnouncements.interfacePatterninstead. (Backport PR #46170, Upstream PR #46093, @salamidrus)Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.5@​sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.5@​sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9bdocker-plugin
quay.io/cilium/docker-plugin:v1.19.5@​sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efeahubble-relay
quay.io/cilium/hubble-relay:v1.19.5@​sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0coperator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.5@​sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16operator-aws
quay.io/cilium/operator-aws:v1.19.5@​sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707operator-azure
quay.io/cilium/operator-azure:v1.19.5@​sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8operator-generic
quay.io/cilium/operator-generic:v1.19.5@​sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4operator
quay.io/cilium/operator:v1.19.5@​sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832ev1.19.4: 1.19.4Compare Source
Summary of Changes
Minor Changes:
--k8s-service-proxy-nameis set,EndpointSlicesare now filtered by theservice.kubernetes.io/service-proxy-namelabel at the watch level, matching howServicesare already filtered, operators with hand-managedEndpointSlicesmust stamp the matching label on those slices. (Backport PR #45755, Upstream PR #45504, @HadrienPatte)Bugfixes:
cilium map listnow displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR #45888, Upstream PR #44951, @skymensch)clustermesh.apiserver.tls.auto.method: certmanager(Backport PR #45630, Upstream PR #45576, @owayss)Configuration
📅 Schedule: (in timezone Europe/Prague)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.