Azure · QxBytes · Oct 14, 2025 · Oct 8, 2025 · Oct 8, 2025 · Oct 8, 2025
@@ -313,8 +313,19 @@ stages:
         vmSize: Standard_B2ms
         k8sVersion: ""
         dependsOn: ["test"]
+
+    # Cilium EBPF Overlay E2E tests
+    - template: singletenancy/cilium-overlay-ebpf/cilium-overlay-e2e-job-template.yaml
+      parameters:
+        name: "cilium_ebpf_overlay_e2e"
+        displayName: Cilium EBPF on AKS Overlay
+        clusterType: overlay-byocni-nokubeproxy-up
+        clusterName: "cilbpfovere2e"
+        vmSize: Standard_B2ms
+        k8sVersion: ""
+        dependsOn: ["test"]
 
-        # Cilium Overlay with hubble E2E tests
+    # Cilium Overlay with hubble E2E tests
     - template: singletenancy/cilium-overlay-withhubble/cilium-overlay-e2e-job-template.yaml
       parameters:
         name: "cilium_h_overlay_e2e"
@@ -449,6 +460,7 @@ stages:
         - cilium_vnetscale_e2e
         - cilium_nodesubnet_e2e
         - cilium_overlay_e2e
+        - cilium_ebpf_overlay_e2e
         - cilium_h_overlay_e2e
         - aks_ubuntu_22_linux_e2e
         - aks_swift_vnetscale_e2e
@@ -481,6 +493,10 @@ stages:
                 name: cilium_overlay_e2e
                 clusterName: "cilovere2e"
                 region: $(REGION_AKS_CLUSTER_TEST)
+              cilium_ebpf_overlay_e2e:
+                name: cilium_ebpf_overlay_e2e
+                clusterName: "cilbpfovere2e"
+                region: $(REGION_AKS_CLUSTER_TEST)
               cilium_h_overlay_e2e:
                 name: cilium_h_overlay_e2e
                 clusterName: "cilwhleovere2e"

@@ -0,0 +1,86 @@
+parameters:
+  name: ""
+  displayName: ""
+  clusterType: ""
+  clusterName: ""
+  vmSize: ""
+  k8sVersion: ""
+  dependsOn: ""
+  os: "linux"
+
+stages:
+  - stage: ${{ parameters.clusterName }}
+    displayName: Create Cluster - ${{ parameters.displayName }}
+    dependsOn:
+      - ${{ parameters.dependsOn }}
+      - setup
+    pool:
+      name: $(BUILD_POOL_NAME_DEFAULT)
+    variables:
+      commitID: $[ stagedependencies.setup.env.outputs['EnvironmentalVariables.commitID'] ]
+    jobs:
+      - template: ../../templates/create-cluster.yaml
+        parameters:
+          name: ${{ parameters.name }}
+          displayName: ${{ parameters.displayName }}
+          clusterType: ${{ parameters.clusterType }}
+          clusterName: ${{ parameters.clusterName }}-$(commitID)
+          vmSize: ${{ parameters.vmSize }}
+          k8sVersion: ${{ parameters.k8sVersion }}
+          dependsOn: ${{ parameters.dependsOn }}
+          osSKU: "AzureLinux"
+          region: $(REGION_AKS_CLUSTER_TEST)
+
+  - stage: ${{ parameters.name }}
+    displayName: E2E - ${{ parameters.displayName }}
+    dependsOn:
+    - setup
+    - publish
+    - ${{ parameters.clusterName }}
+    variables:
+      commitID: $[ stagedependencies.setup.env.outputs['EnvironmentalVariables.commitID'] ]
+      GOPATH: "$(Agent.TempDirectory)/go" # Go workspace path
+      GOBIN: "$(GOPATH)/bin" # Go binaries path
+      modulePath: "$(GOPATH)/src/github.com/Azure/azure-container-networking"
+    pool:
+      name: $(BUILD_POOL_NAME_DEFAULT)
+    jobs:
+      - job: ${{ parameters.name }}
+        displayName: Cilium EBPF Overlay Test Suite - (${{ parameters.name }})
+        timeoutInMinutes: 120
+        pool:
+          name: $(BUILD_POOL_NAME_DEFAULT)
+          demands:
+          - agent.os -equals Linux
+          - Role -equals $(CUSTOM_E2E_ROLE)
+        steps:
+          - template: cilium-overlay-e2e-step-template.yaml
+            parameters:
+              name: ${{ parameters.name }}
+              clusterName: ${{ parameters.clusterName }}-$(commitID)
+              scaleup: 50
+
+      - template: ../../cni/k8s-e2e/k8s-e2e-job-template.yaml
+        parameters:
+          sub: $(BUILD_VALIDATIONS_SERVICE_CONNECTION)
+          clusterName: ${{ parameters.clusterName }}-$(commitID)
+          os: ${{ parameters.os }}
+          cni: cilium
+          dependsOn: ${{ parameters.name }}
+          datapath: true
+          dns: true
+          portforward: true
+          service: true
+
+      - job: failedE2ELogs
+        displayName: "Failure Logs"
+        dependsOn:
+          - ${{ parameters.name }}
+          - cni_${{ parameters.os }}
+        condition: failed()
+        steps:
+          - template: ../../templates/log-template.yaml
+            parameters:
+              clusterName: ${{ parameters.clusterName }}-$(commitID)
+              os: ${{ parameters.os }}
+              cni: cilium
@@ -0,0 +1,114 @@
+parameters:
+  name: ""
+  clusterName: ""
+  scaleup: ""
+
+
+steps:
+  - template: ../../templates/setup-environment.yaml
+
+  - task: AzureCLI@2
+    inputs:
+      azureSubscription: $(BUILD_VALIDATIONS_SERVICE_CONNECTION)
+      scriptLocation: "inlineScript"
+      scriptType: "bash"
+      addSpnToEnvironment: true
+      inlineScript: |
+        set -e
+        make -C ./hack/aks set-kubeconf AZCLI=az CLUSTER=${{ parameters.clusterName }}
+        ls -lah
+        pwd
+        kubectl cluster-info
+        kubectl get pods -Aowide
+
+        # see makefile
+        export AZURE_IPTABLES_MONITOR_IMAGE_REGISTRY=acnpublic.azurecr.io
+        export AZURE_IPTABLES_MONITOR_TAG=$(make azure-iptables-monitor-version)
+        export AZURE_IP_MASQ_MERGER_IMAGE_REGISTRY=acnpublic.azurecr.io
+        export AZURE_IP_MASQ_MERGER_TAG=$(make azure-ip-masq-merger-version)
+        make -C ./hack/aks deploy-ebpf-overlay-cilium
+
+        kubectl get pods -Aowide
+    name: "installCilium"
+    displayName: "Install Cilium EBPF on AKS Overlay"
+
+  - template: ../../templates/cilium-cli.yaml
+
+  - script: |
+      CNS=$(make cns-version) IPAM=$(make azure-ipam-version)
+      kubectl get pods -Aowide
+      sudo -E env "PATH=$PATH" make test-load SCALE_UP=32 OS_TYPE=linux VALIDATE_STATEFILE=true INSTALL_CNS=true INSTALL_OVERLAY=true AZURE_IPAM_VERSION=${IPAM} CNS_VERSION=${CNS} CLEANUP=true
+    retryCountOnTaskFailure: 3
+    name: "aziliumTest"
+    displayName: "Deploy CNS and Run Azilium E2E on AKS Overlay"
+
+  - script: |
+      kubectl get pods -Aowide
+      echo "Waiting < 2 minutes for cilium to be ready"
+      cilium status --wait --wait-duration 2m
+      kubectl get crd -A
+    retryCountOnTaskFailure: 3
+    name: "CiliumStatus"
+    displayName: "Cilium Status"
+
+  - task: AzureCLI@1
+    inputs:
+      azureSubscription: $(BUILD_VALIDATIONS_SERVICE_CONNECTION)
+      scriptLocation: "inlineScript"
+      scriptType: "bash"
+      addSpnToEnvironment: true
+      inlineScript: |
+        set -e
+        kubectl get po -owide -A
+        clusterName=${{ parameters.clusterName }}
+        echo "Restarting nodes"
+        for val in $(az vmss list -g MC_${clusterName}_${clusterName}_$(REGION_AKS_CLUSTER_TEST) --query "[].name" -o tsv); do
+          make -C ./hack/aks restart-vmss AZCLI=az CLUSTER=${clusterName} REGION=$(REGION_AKS_CLUSTER_TEST) VMSS_NAME=${val}
+        done
+    displayName: "Restart Nodes"
+
+  - task: AzureCLI@1
+    inputs:
+      azureSubscription: $(BUILD_VALIDATIONS_SERVICE_CONNECTION)
+      scriptLocation: "inlineScript"
+      scriptType: "bash"
+      addSpnToEnvironment: true
+      inlineScript: |
+        set -e
+        cd test/integration/load
+
+        # Scale Cluster Up/Down to confirm functioning CNS
+        ITERATIONS=2 SCALE_UP=${{ parameters.scaleup }} OS_TYPE=linux go test -count 1 -timeout 30m -tags load -run ^TestLoad$
+        kubectl get pods -owide -A
+
+        cd ../../..
+        echo "Validating Node Restart"
+        make test-validate-state OS_TYPE=linux RESTART_CASE=true
+        kubectl delete ns load-test
+    displayName: "Validate Node Restart"
+    retryCountOnTaskFailure: 3
+
+  - template: ../../templates/cilium-connectivity-tests.yaml
+
+  - template: ../../templates/cilium-identities-check.yaml
+    parameters:
+      ciliumVersionTag: $(CILIUM_VERSION_TAG)
+
+  - script: |
+      echo "Run wireserver and metadata connectivity Tests"
+      bash test/network/wireserver_metadata_test.sh
+    retryCountOnTaskFailure: 3
+    name: "WireserverMetadataConnectivityTests"
+    displayName: "Run Wireserver and Metadata Connectivity Tests"
+
+  - script: |
+      cd hack/scripts
+      chmod +x async-delete-test.sh
+      ./async-delete-test.sh
+      if ! [ -z $(kubectl -n kube-system get ds azure-cns | grep non-existing) ]; then
+        kubectl -n kube-system patch daemonset azure-cns --type json -p='[{"op": "remove", "path": "/spec/template/spec/nodeSelector/non-existing"}]'
+      fi
+    name: "testAsyncDelete"
+    displayName: "Verify Async Delete when CNS is down"
+
+  - template: ../../templates/cilium-mtu-check.yaml
diff --git a/.pipelines/templates/cilium-identities-check.yaml b/.pipelines/templates/cilium-identities-check.yaml
@@ -0,0 +1,55 @@
+parameters:
+  - name: ciliumVersionTag
+    type: string
+
+steps:
+  - script: |
+      ns=`kubectl get ns | grep cilium-test | awk '{print $1}'`
+      echo "##vso[task.setvariable variable=ciliumNamespace]$ns"
+    retryCountOnTaskFailure: 3
+    name: "nsCapture"
+    displayName: "Capture Connectivity Test Namespace"
+
+  - script: |
+      set -e
+      echo "validate pod IP assignment and check systemd-networkd restart"
+      kubectl get pod -owide -A
+      if [ "${{ parameters.ciliumVersionTag }}" = "cilium-nightly-pipeline" ]; then
+        echo "Check cilium identities in $(ciliumNamespace) namepsace during nightly run"
+        echo "expect the identities to be deleted when the namespace is deleted"
+        kubectl get ciliumidentity | grep cilium-test
+      fi
+      make test-validate-state
+      echo "delete cilium connectivity test resources and re-validate state"
+      kubectl delete ns $(ciliumNamespace)
+      kubectl get pod -owide -A
+      make test-validate-state
+    name: "validatePods"
+    displayName: "Validate Pods"
+
+  - script: |
+      if [ "${{ parameters.ciliumVersionTag }}" = "cilium-nightly-pipeline" ]; then
+        kubectl get pod -owide -n $(ciliumNamespace)
+        echo "wait for pod and cilium identity deletion in $(ciliumNamespace) namespace"
+        while true; do
+          pods=$(kubectl get pods -n $(ciliumNamespace) --no-headers=true 2>/dev/null)
+          if [[ -z "$pods" ]]; then
+            echo "No pods found"
+              break
+          fi
+          sleep 2s
+        done
+        sleep 20s
+        echo "Verify cilium identities are deleted from $(ciliumNamespace)"
+        checkIdentity="$(kubectl get ciliumidentity -o json | grep cilium-test | jq -e 'length == 0')"
+        if [[ -n $checkIdentity ]]; then
+          echo "##[error]Cilium Identities still present in $(ciliumNamespace) namespace"
+          exit 1
+        else
+          printf -- "Identities deleted from $(ciliumNamespace) namespace\n"
+        fi
+      else
+        echo "skip cilium identities check for PR pipeline"
+      fi
+    name: "CiliumIdentities"
+    displayName: "Verify Cilium Identities Deletion"
@@ -7,6 +7,7 @@ parameters:
   vmSizeWin: ""
   k8sVersion: ""
   osSkuWin: "Windows2022" # Currently we only support Windows2022
+  osSKU: "Ubuntu"
   dependsOn: ""
   region: ""
   os: linux
@@ -44,7 +45,7 @@ jobs:
             AZCLI=az REGION=${{ parameters.region }} SUB=$(SUB_AZURE_NETWORK_AGENT_BUILD_VALIDATIONS) \
             CLUSTER=${{ parameters.clusterName }} \
             VM_SIZE=${{ parameters.vmSize }} VM_SIZE_WIN=${{ parameters.vmSizeWin }} \
-            OS_SKU_WIN=${{ parameters.osSkuWin }} OS=${{ parameters.os }}
+            OS_SKU_WIN=${{ parameters.osSkuWin }} OS=${{ parameters.os }} OS_SKU=${{ parameters.osSKU }}
 
             echo "Cluster successfully created"
         displayName: Cluster - ${{ parameters.clusterType }}

@@ -0,0 +1,22 @@
+steps:
+  - bash: |
+      echo $UID
+      sudo rm -rf $(System.DefaultWorkingDirectory)/*
+    displayName: "Set up OS environment"
+
+  - checkout: self
+
+  - bash: |
+      go version
+      go env
+      mkdir -p '$(GOBIN)'
+      mkdir -p '$(GOPATH)/pkg'
+      mkdir -p '$(modulePath)'
+      echo '##vso[task.prependpath]$(GOBIN)'
+      echo '##vso[task.prependpath]$(GOROOT)/bin'
+    name: "GoEnv"
+    displayName: "Set up the Go environment"
+
+  - task: KubectlInstaller@0
+    inputs:
+      kubectlVersion: latest