Skip to content

Commit f35ac66

Browse files
burgerdevburgerdev
authored
helm: bump Cilium version to v1.15.19-edg.0 (#3894)
* helm: generate cilium * helm: update cilium ref
1 parent 050c6a2 commit f35ac66

File tree

16 files changed

+294
-55
lines changed

16 files changed

+294
-55
lines changed

‎internal/constellation/helm/BUILD.bazel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,7 @@ go_library(
474474
"charts/coredns/templates/service.yaml",
475475
"charts/coredns/templates/serviceaccount.yaml",
476476
"charts/aws-load-balancer-controller/templates/hpa.yaml",
477+
"charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml",
477478
],
478479
importpath = "github.com/edgelesssys/constellation/v2/internal/constellation/helm",
479480
visibility = ["//:__subpackages__"],

‎internal/constellation/helm/charts/cilium/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: cilium
33
displayName: Cilium
44
home: https://cilium.io/
5-
version: 1.15.8-edg.0
6-
appVersion: 1.15.8-edg.0
5+
version: 1.15.19-edg.0
6+
appVersion: 1.15.19-edg.0
77
kubeVersion: ">= 1.16.0-0"
88
icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.15/Documentation/images/logo-solo.svg
99
description: eBPF-based Networking, Security, and Observability

‎internal/constellation/helm/charts/cilium/README.md

Lines changed: 13 additions & 13 deletions
Large diffs are not rendered by default.

‎internal/constellation/helm/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
node:
2+
id: "host~127.0.0.1~no-id~localdomain"
3+
cluster: "ingress-cluster"
4+
staticResources:
5+
listeners:
6+
{{- if .Values.envoy.prometheus.enabled }}
7+
- name: "envoy-prometheus-metrics-listener"
8+
address:
9+
socketAddress:
10+
address: {{ .Values.ipv4.enabled | ternary "0.0.0.0" "::" | quote }}
11+
portValue: {{ .Values.envoy.prometheus.port }}
12+
{{- if and .Values.ipv4.enabled .Values.ipv6.enabled }}
13+
additionalAddresses:
14+
- address:
15+
socketAddress:
16+
address: "::"
17+
portValue: {{ .Values.envoy.prometheus.port }}
18+
{{- end }}
19+
filterChains:
20+
- filters:
21+
- name: "envoy.filters.network.http_connection_manager"
22+
typedConfig:
23+
"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
24+
statPrefix: "envoy-prometheus-metrics-listener"
25+
routeConfig:
26+
virtualHosts:
27+
- name: "prometheus_metrics_route"
28+
domains:
29+
- "*"
30+
routes:
31+
- name: "prometheus_metrics_route"
32+
match:
33+
prefix: "/metrics"
34+
route:
35+
cluster: "/envoy-admin"
36+
prefixRewrite: "/stats/prometheus"
37+
httpFilters:
38+
- name: "envoy.filters.http.router"
39+
typedConfig:
40+
"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
41+
internalAddressConfig:
42+
cidrRanges:
43+
{{- if .Values.ipv4.enabled }}
44+
- addressPrefix: "10.0.0.0"
45+
prefixLen: 8
46+
- addressPrefix: "172.16.0.0"
47+
prefixLen: 12
48+
- addressPrefix: "192.168.0.0"
49+
prefixLen: 16
50+
- addressPrefix: "127.0.0.1"
51+
prefixLen: 32
52+
{{- end }}
53+
{{- if .Values.ipv6.enabled }}
54+
- addressPrefix: "::1"
55+
prefixLen: 128
56+
{{- end }}
57+
streamIdleTimeout: "0s"
58+
{{- end }}
59+
- name: "envoy-health-listener"
60+
address:
61+
socketAddress:
62+
address: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
63+
portValue: {{ .Values.envoy.healthPort }}
64+
{{- if and .Values.ipv4.enabled .Values.ipv6.enabled }}
65+
additionalAddresses:
66+
- address:
67+
socketAddress:
68+
address: "::1"
69+
portValue: {{ .Values.envoy.healthPort }}
70+
{{- end }}
71+
filterChains:
72+
- filters:
73+
- name: "envoy.filters.network.http_connection_manager"
74+
typedConfig:
75+
"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
76+
statPrefix: "envoy-health-listener"
77+
routeConfig:
78+
virtual_hosts:
79+
- name: "health"
80+
domains:
81+
- "*"
82+
routes:
83+
- name: "health"
84+
match:
85+
prefix: "/healthz"
86+
route:
87+
cluster: "/envoy-admin"
88+
prefixRewrite: "/ready"
89+
httpFilters:
90+
- name: "envoy.filters.http.router"
91+
typedConfig:
92+
"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
93+
internalAddressConfig:
94+
cidrRanges:
95+
{{- if .Values.ipv4.enabled }}
96+
- addressPrefix: "10.0.0.0"
97+
prefixLen: 8
98+
- addressPrefix: "172.16.0.0"
99+
prefixLen: 12
100+
- addressPrefix: "192.168.0.0"
101+
prefixLen: 16
102+
- addressPrefix: "127.0.0.1"
103+
prefixLen: 32
104+
{{- end }}
105+
{{- if .Values.ipv6.enabled }}
106+
- addressPrefix: "::1"
107+
prefixLen: 128
108+
{{- end }}
109+
streamIdleTimeout: "0s"
110+
clusters:
111+
- name: "ingress-cluster"
112+
type: "ORIGINAL_DST"
113+
connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
114+
lbPolicy: "CLUSTER_PROVIDED"
115+
typedExtensionProtocolOptions:
116+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
117+
"@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
118+
commonHttpProtocolOptions:
119+
idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
120+
maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
121+
maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
122+
useDownstreamProtocolConfig: {}
123+
cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
124+
- name: "egress-cluster-tls"
125+
type: "ORIGINAL_DST"
126+
connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
127+
lbPolicy: "CLUSTER_PROVIDED"
128+
typedExtensionProtocolOptions:
129+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
130+
"@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
131+
commonHttpProtocolOptions:
132+
idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
133+
maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
134+
maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
135+
upstreamHttpProtocolOptions: {}
136+
useDownstreamProtocolConfig: {}
137+
cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
138+
transportSocket:
139+
name: "cilium.tls_wrapper"
140+
typedConfig:
141+
"@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext"
142+
- name: "egress-cluster"
143+
type: "ORIGINAL_DST"
144+
connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
145+
lbPolicy: "CLUSTER_PROVIDED"
146+
typedExtensionProtocolOptions:
147+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
148+
"@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
149+
commonHttpProtocolOptions:
150+
idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
151+
maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
152+
maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
153+
useDownstreamProtocolConfig: {}
154+
cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
155+
- name: "ingress-cluster-tls"
156+
type: "ORIGINAL_DST"
157+
connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
158+
lbPolicy: "CLUSTER_PROVIDED"
159+
typedExtensionProtocolOptions:
160+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
161+
"@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
162+
commonHttpProtocolOptions:
163+
idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
164+
maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
165+
maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
166+
upstreamHttpProtocolOptions: {}
167+
useDownstreamProtocolConfig: {}
168+
cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
169+
transportSocket:
170+
name: "cilium.tls_wrapper"
171+
typedConfig:
172+
"@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext"
173+
- name: "xds-grpc-cilium"
174+
type: "STATIC"
175+
connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
176+
loadAssignment:
177+
clusterName: "xds-grpc-cilium"
178+
endpoints:
179+
- lbEndpoints:
180+
- endpoint:
181+
address:
182+
pipe:
183+
path: "/var/run/cilium/envoy/sockets/xds.sock"
184+
typedExtensionProtocolOptions:
185+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
186+
"@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
187+
explicitHttpConfig:
188+
http2ProtocolOptions: {}
189+
- name: "/envoy-admin"
190+
type: "STATIC"
191+
connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
192+
loadAssignment:
193+
clusterName: "/envoy-admin"
194+
endpoints:
195+
- lbEndpoints:
196+
- endpoint:
197+
address:
198+
pipe:
199+
path: "/var/run/cilium/envoy/sockets/admin.sock"
200+
dynamicResources:
201+
ldsConfig:
202+
apiConfigSource:
203+
apiType: "GRPC"
204+
transportApiVersion: "V3"
205+
grpcServices:
206+
- envoyGrpc:
207+
clusterName: "xds-grpc-cilium"
208+
setNodeOnFirstMessageOnly: true
209+
resourceApiVersion: "V3"
210+
cdsConfig:
211+
apiConfigSource:
212+
apiType: "GRPC"
213+
transportApiVersion: "V3"
214+
grpcServices:
215+
- envoyGrpc:
216+
clusterName: "xds-grpc-cilium"
217+
setNodeOnFirstMessageOnly: true
218+
resourceApiVersion: "V3"
219+
bootstrapExtensions:
220+
- name: "envoy.bootstrap.internal_listener"
221+
typedConfig:
222+
"@type": "type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
223+
overloadManager:
224+
resourceMonitors:
225+
- name: "envoy.resource_monitors.global_downstream_max_connections"
226+
typedConfig:
227+
"@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig"
228+
max_active_downstream_connections: "50000"
229+
admin:
230+
address:
231+
pipe:
232+
path: "/var/run/cilium/envoy/sockets/admin.sock"

‎internal/constellation/helm/charts/cilium/templates/cilium-envoy/configmap.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ metadata:
1111
{{- toYaml . | nindent 4 }}
1212
{{- end }}
1313
data:
14-
{{- (tpl (.Files.Glob "files/cilium-envoy/configmap/bootstrap-config.json").AsConfig .) | nindent 2 }}
15-
14+
# Keep the key name as bootstrap-config.json to avoid breaking changes
15+
bootstrap-config.json: |
16+
{{- (tpl (.Files.Get "files/cilium-envoy/configmap/bootstrap-config.yaml") .) | fromYaml | toJson | nindent 4 }}
1617
{{- end }}

‎internal/constellation/helm/charts/cilium/templates/cilium-envoy/daemonset.yaml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,6 @@ spec:
2626
template:
2727
metadata:
2828
annotations:
29-
{{- if and .Values.proxy.prometheus.enabled .Values.envoy.prometheus.enabled (not .Values.envoy.prometheus.serviceMonitor.enabled) }}
30-
prometheus.io/port: "{{ .Values.proxy.prometheus.port | default .Values.envoy.prometheus.port }}"
31-
prometheus.io/scrape: "true"
32-
{{- end }}
3329
{{- if .Values.envoy.rollOutPods }}
3430
# ensure pods roll when configmap updates
3531
cilium.io/cilium-envoy-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-envoy/configmap.yaml") . | sha256sum | quote }}

‎internal/constellation/helm/charts/cilium/templates/hubble-ui/_nginx.tpl

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,24 +13,12 @@ server {
1313
proxy_set_header Host $host;
1414
proxy_set_header X-Real-IP $remote_addr;
1515
16-
# CORS
17-
add_header Access-Control-Allow-Methods "GET, POST, PUT, HEAD, DELETE, OPTIONS";
18-
add_header Access-Control-Allow-Origin *;
19-
add_header Access-Control-Max-Age 1728000;
20-
add_header Access-Control-Expose-Headers content-length,grpc-status,grpc-message;
21-
add_header Access-Control-Allow-Headers range,keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout;
22-
if ($request_method = OPTIONS) {
23-
return 204;
24-
}
25-
# /CORS
26-
2716
location {{ .Values.hubble.ui.baseUrl }}api {
2817
{{- if not (eq .Values.hubble.ui.baseUrl "/") }}
2918
rewrite ^{{ (trimSuffix "/" .Values.hubble.ui.baseUrl) }}(/.*)$ $1 break;
3019
{{- end }}
3120
proxy_http_version 1.1;
3221
proxy_pass_request_headers on;
33-
proxy_hide_header Access-Control-Allow-Origin;
3422
{{- if eq .Values.hubble.ui.baseUrl "/" }}
3523
proxy_pass http://127.0.0.1:8090;
3624
{{- else }}

‎internal/constellation/helm/charts/cilium/templates/hubble/tls-certmanager/relay-client-secret.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,9 @@ spec:
1919
duration: {{ printf "%dh0m0s" (mul .Values.hubble.tls.auto.certValidityDuration 24) }}
2020
privateKey:
2121
rotationPolicy: Always
22+
isCA: false
23+
usages:
24+
- signing
25+
- key encipherment
26+
- client auth
2227
{{- end }}

‎internal/constellation/helm/charts/cilium/templates/hubble/tls-certmanager/relay-server-secret.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,9 @@ spec:
2828
duration: {{ printf "%dh0m0s" (mul .Values.hubble.tls.auto.certValidityDuration 24) }}
2929
privateKey:
3030
rotationPolicy: Always
31+
isCA: false
32+
usages:
33+
- signing
34+
- key encipherment
35+
- server auth
3136
{{- end }}

‎internal/constellation/helm/charts/cilium/templates/hubble/tls-certmanager/server-secret.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,10 @@ spec:
2929
duration: {{ printf "%dh0m0s" (mul .Values.hubble.tls.auto.certValidityDuration 24) }}
3030
privateKey:
3131
rotationPolicy: Always
32+
isCA: false
33+
usages:
34+
- signing
35+
- key encipherment
36+
- server auth
37+
- client auth
3238
{{- end }}

0 commit comments

Comments
 (0)