diversario/connect-mongostore 57
MongoDB session store for Connect/Express.
Advent of code solutions.
diversario/clickable-package-json 1
Chrome extension that turns dependencies in package.json into links.
Drills and Exercises from Stroustrup's "Principles and Practice Using C++"
abrader/classroom-control-vf 0
Control repository for the Virtual Fundamentals training course
Client for operating the AR Drone 2 Parrot
A high-level HTTP / REST client for Node
Autoscaling components for Kubernetes
diversario/aws-iam-authenticator 0
A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster
startedmozilla/rr
started time in 5 days
Pull request review commentcilium/cilium
Add a `node` label to agent metrics.
spec: interval: 10s honorLabels: true path: /metrics+ relabelings:+ - replacement: ${1}
Sorry about lack of response!
Re this line: I understand it's redundant but IMO it's ok to keep as it for people who're reading this and trying to understand how things work (definitely helped me).
comment created time in 16 days
issue commentcilium/cilium
Cilium agent logs complain about `Unable to fetch kubernetes labels`
Seeing this currently happening to one Cilium 1.7.4 agent in k8s 1.16:
Controller Status: 157/159 healthy
Name Last success Last error Count Message
resolve-labels-deployment-4459/webserver-deployment-c7997dcc8-tgq7m never 2m26s ago 231 pod.core "webserver-deployment-c7997dcc8-tgq7m" not found
sync-to-k8s-ciliumendpoint (3912) never 2m8s ago 231 namespaces "deployment-4459" not found
the pod and namespace in question were created and removed by Sonobuoy. It doesn't appear to be causing actual issues. Running cilium endpoint disconnect 3912 resolved the complaints.
comment created time in 21 days
startedwallix/awless
started time in a month
push eventdiversario/cilium
commit sha eacecc6a5c0dce58fb681293ab9bfdc539576ab9
doc: uniformize name when referring to Hubble Relay The documentation is pretty inconsistent as it sometimes refers to Hubble-relay, hubble-relay, Hubble relay or Hubble Relay or just Relay. This commit changes references to Hubble Relay for the sake of consistency. Signed-off-by: Robin Hahling <[email protected]>
commit sha cd04ad4f5ce44b3d5cf94e553b7dcda91e38be76
doc: add "observing flows with Hubble Relay" to troubleshooting section Signed-off-by: Robin Hahling <[email protected]>
commit sha e1e1f50c5b4836518e30f30a2ee3ca947b15e177
test/helpers: allow passing custom number of requests to helpers.Ping() Let's offer to pass a custom number of ICMP requests for the cases where the setup might not be ready to process them just yet. Introduce a new PingWithCount() helper that takes an integer passed to ping's -c option. The initial idea was to pass an interval through the "-i" option instead, but the ping provided by BusyBox does not support it, leading to failures on some environments. Fixes: #11741 Signed-off-by: Quentin Monnet <[email protected]>
commit sha 6dd679d00c425e8f7b34d173941631c8d938e910
test: enquote bugtool archive folder name in bash command There are a couple of tests that contain parenthesis in their names. Namely, in K8sServices: - Tests NodePort (kube-proxy) - Tests NodePort (kube-proxy) with externalTrafficPolicy=Local Because of the parenthesis, handling directories named after the tests can be more delicate in bash, and we need to make sure that the parenthesis are not interpreted. So far this was not done properly, and bash complains with: bash: -c: line 0: syntax error near unexpected token `(' Fix it by using the %q format specifier for the relevant bash commands. Fixes: #11094 Signed-off-by: Quentin Monnet <[email protected]>
commit sha 390f8b8077a86af06af734ea1dfaeb2f095544df
test/K8sServices: fix expectations in testExternalTrafficPolicyLocal() The function testExternalTrafficPolicyLocal() used to check the "externalTrafficPolicy=Local" flag for kube-proxy or its BPF replacement uses a set of curl requests to check connectivity. Requests from k8s2 to the test service (deployed on k8s2 with local policy) via k8s2 are expected to succeed, while requests sent to k8s1 are all supposed to fail. However, it seems that this is not the expected behaviour. External requests sent to k8s1 should fail indeed, but local requests, emitted from pods located on k8s1, should not be affected and should be forwarded to the backend on k8s2. This is visible in the iptables-save dump from the cilium pod on k8s1 (extract): -A KUBE-XLB-FXQVMYTRN72EUJRL -s 10.10.0.0/16 -m comment --comment "Redirect pods trying to reach external loadbalancer VIP to clusterIP" -j KUBE-SVC-FXQVMYTRN72EUJRL -A KUBE-XLB-FXQVMYTRN72EUJRL -m comment --comment "masquerade LOCAL traffic for default/test-lb-local-k8s2:http LB IP" -m addrtype --src-type LOCAL -j KUBE-MARK-MASQ -A KUBE-XLB-FXQVMYTRN72EUJRL -m comment --comment "route LOCAL traffic for default/test-lb-local-k8s2:http LB IP to service chain" -m addrtype --src-type LOCAL -j KUBE-SVC-FXQVMYTRN72EUJRL -A KUBE-XLB-FXQVMYTRN72EUJRL -m comment --comment "default/test-lb-local-k8s2:http has no local endpoints" -j KUBE-MARK-DROP -A KUBE-XLB-R5LOCOWLR542QA7J -s 10.10.0.0/16 -m comment --comment "Redirect pods trying to reach external loadbalancer VIP to clusterIP" -j KUBE-SVC-R5LOCOWLR542QA7J -A KUBE-XLB-R5LOCOWLR542QA7J -m comment --comment "masquerade LOCAL traffic for default/test-nodeport-local-k8s2:http LB IP" -m addrtype --src-type LOCAL -j KUBE-MARK-MASQ -A KUBE-XLB-R5LOCOWLR542QA7J -m comment --comment "route LOCAL traffic for default/test-nodeport-local-k8s2:http LB IP to service chain" -m addrtype --src-type LOCAL -j KUBE-SVC-R5LOCOWLR542QA7J -A KUBE-XLB-R5LOCOWLR542QA7J -m comment --comment "default/test-nodeport-local-k8s2:http has no local endpoints" -j KUBE-MARK-DROP Note the KUBE-MARK-DROP target is only used when the source is not of "--src-type LOCAL". By contrast, k8s2 is able to route all requests to its backend for the service: -A KUBE-XLB-FXQVMYTRN72EUJRL -s 10.10.0.0/16 -m comment --comment "Redirect pods trying to reach external loadbalancer VIP to clusterIP" -j KUBE-SVC-FXQVMYTRN72EUJRL -A KUBE-XLB-FXQVMYTRN72EUJRL -m comment --comment "masquerade LOCAL traffic for default/test-lb-local-k8s2:http LB IP" -m addrtype --src-type LOCAL -j KUBE-MARK-MASQ -A KUBE-XLB-FXQVMYTRN72EUJRL -m comment --comment "route LOCAL traffic for default/test-lb-local-k8s2:http LB IP to service chain" -m addrtype --src-type LOCAL -j KUBE-SVC-FXQVMYTRN72EUJRL -A KUBE-XLB-FXQVMYTRN72EUJRL -m comment --comment "Balancing rule 0 for default/test-lb-local-k8s2:http" -j KUBE-SEP-TJ5BBRFPOOF55I4D -A KUBE-XLB-R5LOCOWLR542QA7J -s 10.10.0.0/16 -m comment --comment "Redirect pods trying to reach external loadbalancer VIP to clusterIP" -j KUBE-SVC-R5LOCOWLR542QA7J -A KUBE-XLB-R5LOCOWLR542QA7J -m comment --comment "masquerade LOCAL traffic for default/test-nodeport-local-k8s2:http LB IP" -m addrtype --src-type LOCAL -j KUBE-MARK-MASQ -A KUBE-XLB-R5LOCOWLR542QA7J -m comment --comment "route LOCAL traffic for default/test-nodeport-local-k8s2:http LB IP to service chain" -m addrtype --src-type LOCAL -j KUBE-SVC-R5LOCOWLR542QA7J -A KUBE-XLB-R5LOCOWLR542QA7J -m comment --comment "Balancing rule 0 for default/test-nodeport-local-k8s2:http" -j KUBE-SEP-TZWVS7R6L6CPM73Z But then, why did the CI fail to catch this before? This is because the testCurlFailFromPodInHostNetNS() function used by the test does not call helpers.CurlFail() correctly, and bash fails to parse and run the command line, thus always returning an error code which we wrongly interpreted as a failed attempt to connect. The request will be fixed in a subsequent commit. For now, fix the test logics by expecting requests from k8s1 to k8s1 to succeed. Fixes: 54304819a1d2 ("test: Extend externalTrafficPolicy=Local tests") Signed-off-by: Quentin Monnet <[email protected]>
commit sha 8260696c54bb2e6bcb9295c962d27edda87b6877
test/K8sServices: skip checks for BPF with externalTrafficPolicy=Local A previous commit fixed the expectations for the results for the curl requests in testExternalTrafficPolicyLocal(). This should now be working with kube-proxy, however it turns out the behaviour of the BPF replacement for kube-proxy behaves differently for local traffic. The test is still not detecting this issue because of the broken curl requests that will be fixed in a subsequent patch, but let's skip and comment the particular checks that are known to fail with Nodeport BPF. Signed-off-by: Quentin Monnet <[email protected]>
commit sha 9ee7f99d84a972917e5e89b254a9edb462414b8d
test/K8sServices: fix a call to helpers.CurlFail() helpers.CurlFail() can take optional arguments, and at one location this is used to pass the "--max-time" option to the curl command line. But these optional arguments for helpers.CurlFail() are not intended to be used that way; they should instead be used to format the target URL, which is supposed to be a string containing the relevant format specifiers. Because in the current case, the URL provided has no format specifier, go appends the additional arguments at the end, with extraneous characters. So instead of producing the final curl command: curl [...] http://192.168.36.11:30861 --max-time 3 [...] We actually get: curl [...] --max-time 20 http://192.168.36.11:30861%!(EXTRA string=--max-time 3) [...] The first "--max-time 20" is added by helpers.CurlFail() itself. Then of course bash fails to interpret that command, and complains with: bash: -c: line 0: syntax error near unexpected token `(' In order to fix it, let's remove the "--max-time 3" argument entirely. As we can see from the resulting command line, "--max-time" is already used (with "CurlMaxTimeout"). And it is useless anyway, since we actually expect to timeout on the value passed through the "--connect-timeout" option (currently 5 seconds). While at it, let's also fix the typo in the comments for helpers.CurlFail(), and remove the explicit argument indices used for generating the curl command. They were useful at a time when one of the arguments was used multiple times, but they are unnecessary and only confusing now. Fixes: 54304819a1d2 ("test: Extend externalTrafficPolicy=Local tests") Signed-off-by: Quentin Monnet <[email protected]>
commit sha 02b43fc85e602bceac61914d7117281768a5f079
datapath: Only NOTRACK proxy return traffic going to Cilium datapath Proxy return traffic accessed via a k8s NodePort will not be routed back via Cilium bpf datapath, so such traffic needs to have possible reverse NAT applied. Setting NOTRACK prevented this. Fix this by setting NOTRACK only on packets heading back to the Cilium datapath (-o lxc+ and -o cilium_host). Signed-off-by: Jarno Rajahalme <[email protected]>
commit sha a2c332096cde7bf0f49afe9024ac1e6228798454
api: Add SessionAffinity field to KubeProxyReplacementFeatures Going to be used to report whether session affinity has been enabled. Signed-off-by: Martynas Pumputis <[email protected]>
commit sha 04edb26b477c2816f7c4e6a29259a253c3f632ce
daemon/cli: Add SessionAffinity to cilium status The example output: [..] KubeProxyReplacement: Strict (wlp3s0) [NodePort (SNAT, 30000-32767, XDP: NONE), HostPort, ExternalIPs, HostReachableServices (TCP, UDP), SessionAffinity] Signed-off-by: Martynas Pumputis <[email protected]>
commit sha a7cbab1f56ebd965b3ec6cd3be0d925ceaa344f1
Update stable releases Signed-off-by: Joe Stringer <[email protected]>
commit sha eee8b09e14b43f78de792f59364db03fa1abb019
cilium: rename --node-port-acceleration=none to =disabled Be more consistent and rename to "disable" since this is common for various other flags already. Signed-off-by: Daniel Borkmann <[email protected]>
commit sha fddc86cd05f54a1a8055768fe9017522abc1557a
vagrant: bump net-next vagrant box version Pull in bpf-next kernel fix for bpf_skb_adjust_room() helper [0]. [0] https://lore.kernel.org/bpf/[email protected]/ Signed-off-by: Daniel Borkmann <[email protected]>
commit sha 31e2e1166b2c937c4150527d01c5de5a8b9c1f5a
agent: Log endpoint create, patch, and delete requests Add an info log message for all create, patch and dlete request. The volume should be low enough. Signed-off-by: Thomas Graf <[email protected]>
commit sha 27b0a88ba587491f2704e6194e6a5930293cf713
agent: Cancel endpoint create request as it becomes obsolete So far, the endpoint create request has relied on timing out eventually and checking liveness of the endpoint in various spots to then abort the creation. This has the disadvantage that if a blocking operation such as etcd interactions are delayed for a long time, kubelet may schedule a new pod creation attempt while the old endpoint is still being created, leading to parallel endpoint create events for the same pod. Establish a new map which keeps track of all endpoint create requests and: * Cancel any endpoint create request if an endpoint delete request for the same endpoint is being received. * Cancel any endpoint create request if a new endpoint create request for the same pod is being received. The new request will continue. In order to assist in troubleshooting of create endpoint related issues, the list of ongoing endpoint creations is printed in the debuginfo output. Signed-off-by: Thomas Graf <[email protected]>
commit sha 53a80b0057d739cf4f98b489191891a5b212279e
defaults: Increase IPAM expiration to 10 minutes It has been observed that 3 minutes is not sufficient. Endpoint creations are currently dependant on kubelet cancelling the request or scheduling a new one. The IPAM expiration may never ooccur before such an event happens as otherwise the IP is returned prematurely. Signed-off-by: Thomas Graf <[email protected]>
commit sha 9603331d85811a5bf14e6aebd62bf4e93acc7cfa
docs: Rework live-preview to use docker container This way, we can rely upon the dependencies provided by the container rather than forcing folks to install various dependencies (even if mainly managed by pipenv). Signed-off-by: Joe Stringer <[email protected]>
commit sha 651a3a8a39c580cd7a54b5c4c2370ef36631af8f
test: Fix NodePort acceleration param The node-port-acceleration param "none" has been changed to "disabled". Fix: eee8b09e14 ("cilium: rename --node-port-acceleration=none to =disabled") Signed-off-by: Martynas Pumputis <[email protected]>
commit sha f743919b166f3d44fee72452bec72287a36b2b0f
docs: quote helm flags with brackets Due to zsh using square brackets for globbing/pattern matching, our etcd endpoints examples failed with `zsh: no matches found: global.etcd.endpoints[0]=url`. Grepping through the docs didn't find any other commands using brackets, so only etcd-endpoint related ones are in quotes. Signed-off-by: Maciej Kwiek <[email protected]>
commit sha e158b636fd1bc27470400f592ce2152f9e8e3f50
test: Disable flaky RuntimeKVStoreTest tests Related: #11895 Signed-off-by: Paul Chaignon <[email protected]>
push time in a month
PR opened cilium/cilium
Please ensure your pull request adheres to the following guidelines:
- [x] For first time contributors, read Submitting a pull request
- [x] All code is covered by unit and/or runtime tests where feasible.
- [x] All commits contain a well written commit description including a title,
description and a
Fixes: #XXXline if the commit addresses a particular GitHub issue. - [x] All commits are signed off. See the section Developer’s Certificate of Origin
- [x] Provide a title or release-note blurb suitable for the release notes.
- [x] Thanks for contributing!
<!-- Description of change -->
Exposing node name allows correlating Cilium metrics to node metrics for more advanced recording rules/alerts, for example: ignore endpoint health on nodes aged less than 2 minutes.
<!-- Enter the release note text here if needed or remove this section! -->
pr created time in a month
startedbpftools/linux-observability-with-bpf
started time in a month
startediovisor/kubectl-trace
started time in a month
starteddarkbitio/aws-recon
started time in a month
starteddrathier/stack-overflow-import
started time in a month
startedsantinic/how2
started time in a month
push eventdiversario/neutral-face-emoji-tools
commit sha 0c7a11120d0a24fa6b4fc33fd60522304d890f42
shit's happening
push time in a month
created tagdiversario/neutral-face-emoji-tools
Utilities that make life as a Slack emoji addict a little easier.
created time in a month
push eventdiversario/neutral-face-emoji-tools
commit sha d40d07f4b895076bc3eab67e39cdc70fc03048c5
save preferences
push time in a month
startedkubernetes/cli-runtime
started time in a month
push eventdiversario/raytracing-in-one-weekend
commit sha 8e72fae67fcf07c41af838133d567c39f19b7382
lambertian diffuse
push time in a month
push eventdiversario/raytracing-in-one-weekend
commit sha bfab480e03734b94abf77a35c75fa43616f27b21
diffuse! but not yet lambertian
push time in a month
push eventdiversario/raytracing-in-one-weekend
commit sha 21086704e09568ae17f110c1300f0e9bd7bdebf7
fuck yeah antialiasing
push time in a month
push eventdiversario/raytracing-in-one-weekend
commit sha de43f2370b107561563b610d35b81e2c73a9be22
awww yisssss
push time in 2 months
push eventdiversario/raytracing-in-one-weekend
commit sha 10dd40fb24739bcb822541d4c50e3fbacd9a615a
hittable list
push time in 2 months
push eventdiversario/raytracing-in-one-weekend
commit sha 572b8dbaf4a162af277574fadca3f2826bd1027b
normals!!
push time in 2 months
push eventdiversario/raytracing-in-one-weekend
commit sha c2dc872c8aed884b4efbbfd38ebd5b5133d0f3c1
it's a circle
push time in 2 months
push eventdiversario/raytracing-in-one-weekend
commit sha ef0a59bec5da5b258e4e92c9c8aa75eb124d34e2
wip
commit sha 25dd76c3387ea21a9cfe3c4adadc36ed727b0f15
aw shit it's a sky
push time in 2 months
push eventdiversario/raytracing-in-one-weekend
commit sha 3aa39808b978794a9c48c75017a4185e31bbe3eb
damn wtf rust modules
push time in 2 months
push eventdiversario/raytracing-in-one-weekend
commit sha a4547b3d6380b8c48222282e4a1584252edf346b
something is compiling
push time in 2 months
startedda667/Building_Virtual_Machine_Labs-Live_Training
started time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha 0b85031c816588cee2fba5b1b8990ed861d087d9
wip on bulk delete
commit sha 1617fbb93de8150e6057c11edf65ac69042255d7
seems to be working
commit sha b22b038fc0b2e8700a739ce73af86476d55c4498
fix deletion of unowned emoji
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha 1617fbb93de8150e6057c11edf65ac69042255d7
seems to be working
push time in 2 months
create barnchdiversario/neutral-face-emoji-tools
created branch time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha 62b716b634b443c0c8035191cb6740e0047d3d95
wtf
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha 360465329b0000e330f1970fa649c24acb5c0014
wip
commit sha 98a69d3a8246921d51f747cc6d411010afa357e5
better logging
commit sha 2e2236f5e2c57e9e9dab612d59f99843d5ff6989
update
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha 98a69d3a8246921d51f747cc6d411010afa357e5
better logging
push time in 2 months
create barnchdiversario/neutral-face-emoji-tools
branch : adding-overwrite-and-throttling
created branch time in 2 months
startedbrandonskerritt/RustScan
started time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha b7268b899b5f89f7e1f491ef478912c415123a69
update
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha c50a1bf4d672e6e1d810e83f94f869b21a31487a
add privacy policy
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha b9712164ffd52222bca36ea80bd1d3769e1f63d1
fix bundle thingy
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha 977462d4630dee3c8bf8542f030b9cd010a0cdbe
update logo
push time in 2 months
push eventdiversario/neutral-face-emoji-tools
commit sha a69f5cecb7841aa9d322e7f63ee7d73e4353506b
Add Safari extension xcode project
push time in 2 months
starteduswitch/yggdrasil
started time in 2 months
fork diversario/neutral-face-emoji-tools
Utilities that make life as a Slack emoji addict a little easier.
fork in 2 months
startedcdanis/emojifs
started time in 2 months
startedOverv/outrun
started time in 2 months
issue commentroboll/helmfile
[Question] Helmfile tries to render values files
Facing exact same error with Helmfile v0.121.1.
In this case, the error
COMBINED OUTPUT:
Error: parse error at (prometheus-operator/templates/helmx.all.yaml:1665): undefined variable "$labels"
only shows up if I attempt to specify a patch for the prometheus-operator chart, like so:
- name: prometheus-operator
chart: plaid/prometheus-operator
namespace: monitoring
jsonPatches:
- target:
group: monitoring.coreos.com
version: v1
kind: PrometheusRule
name: prometheus-operator-kubernetes-apps
namespace: monitoring
patch:
- op: replace
path: /spec/groups/0/rules/0/for
value: 1h
I think this is because all the manifests are merged into one file, and kustomize (?) then runs on it, thinking it's a go template.
The line where the error points is this:
message: The configuration of the instances of the Alertmanager cluster `{{$labels.service}}` are out of sync.
comment created time in 2 months
startedoneinfra/oneinfra
started time in 2 months
delete branch diversario/cert-manager
delete branch : 2159-remove-custom-retryer
delete time in 3 months
startedcyberark/kubeletctl
started time in 3 months
startedaws/amazon-ec2-instance-selector
started time in 3 months