loader: infrastructure for attaching SKB programs using the tcx API #32202
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds the necessary infrastructure to attach bpf programs operating on sk_buff using the kernel's new tcx hook. Enabling the functionality in the agent's endpoint attachment path happens in a follow-up commit. Signed-off-by: Robin Gögge <r.goegge@isovalent.com> Co-authored-by: Timo Beckers <timo@isovalent.com>
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
ti-mo
added
the
release-note/misc
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
|
/test |
…value This commit puts the tcx logic in the endpoint attachment path and enables it by default. The 'enableTCX' Helm value is added to disable tcx attachments if external tooling hasn't caught up yet, as attaching a tcx program to an interface disables the legacy tc pipeline. The agent upgrades and downgrades interfaces seamlessly based on tcx being enabled or not, so any existing workloads are migrated automatically at runtime, without having to reboot the node. Signed-off-by: Timo Beckers <timo@isovalent.com>
ti-mo
force-pushed
the
tb/tcx-infrastructure
branch
from
2f50d55
to
5b42a5f
Compare
This is needed for tcx given it does not automatically clear the tc_classid cb field and could contain garbage from upper layers of the stack. This later maps to skb->tc_index and given in Cilium code we utilize it, we should explicitly zero the field like we do with other cb buffers. Under tcx and endpoint routes, the test below breaks if the field if not cleared: ./cilium-cli connectivity test --test client-ingress After the fix the test passes. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
/test |
borkmann
approved these changes
Apr 26, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Split off from #30103, this pulls out the tcx infrastructure so it can be merged without enabling the feature.
@rgo3