Ambient cni node agent: Reconcile pod iptables rules on startup #53906
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
istio-testing
added
the
do-not-merge/work-in-progress
istio-testing
added
the
size/XXL
bleggett
force-pushed
the
bleggett/ambient-cni-reconcile-pods-on-startup
branch
from
54e1131 to
23143de
Compare
bleggett
added
the
cherrypick/release-1.24
bleggett
force-pushed
the
bleggett/ambient-cni-reconcile-pods-on-startup
branch
from
23143de to
ff9e813
Compare
Change-Id: I7053c7e8665c320b871be8649bab5c4d0c7fc3c6
Change-Id: Ib636985911338401aeefb9d03e8789af2b65e9c9
Change-Id: Id949704a143602c9b2ff59d35394088db186f4bc
istio-testing
added
the
needs-rebase
Signed-off-by: Benjamin Leggett <[email protected]>
Signed-off-by: Benjamin Leggett <[email protected]>
bleggett
force-pushed
the
bleggett/ambient-cni-reconcile-pods-on-startup
branch
from
a3d557f to
c72f0b9
Compare
istio-testing
removed
the
needs-rebase
Signed-off-by: Benjamin Leggett <[email protected]>
bleggett
force-pushed
the
bleggett/ambient-cni-reconcile-pods-on-startup
branch
from
c72f0b9 to
d5313c5
Compare
Signed-off-by: Benjamin Leggett <[email protected]>
Signed-off-by: Benjamin Leggett <[email protected]>
Signed-off-by: Benjamin Leggett <[email protected]>
bleggett
changed the title
istio-testing
removed
the
do-not-merge/work-in-progress
bleggett
added
do-not-merge
|
PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
istio-testing
added
the
needs-rebase
|
Will rebase when #53153 goes in. |
bleggett
added a commit
to bleggett/istio
that referenced
this pull request
Dec 20, 2024
Signed-off-by: Benjamin Leggett <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please provide a description of this PR:
This depends on (and currently pulls in, as that's not merged yet) #53153, and fixes istio/ztunnel#1360
Most of the interesting bits are in that PR - this one just makes sure we run through all the "existing" ambient pods we find on ambient node agent startup, and run the iptables logic (which as of #53153 now support idempotency/reconciliation) on all of them.
This means that if you upgrade
istio-cniit will make sure to rewrite all inpod iptables rules for pods (that would have been configured by the older version) to match what the current release expects.(also did minor reordering of
net.goandserver.goto be less confusing to navigate, apologies)Note
Note that this PR is targeting 1.25, and is defaulting this feature to ON.