deps: bump cilium to v1.20.0 and migrate relocated internal APIs - #2628
Open
Quang Nguyen (nddq) wants to merge 1 commit into
Open
deps: bump cilium to v1.20.0 and migrate relocated internal APIs#2628Quang Nguyen (nddq) wants to merge 1 commit into
Quang Nguyen (nddq) wants to merge 1 commit into
Conversation
Retina Code Coverage ReportTotal coverage increased from
|
| Impacted Files | Coverage | |
|---|---|---|
| operator/cmd/cilium-crds/zap_linux.go | 0.0% ... 100.0% (100.0%) |
⬆️ |
| cmd/hubble/daemon_main_linux.go | 0.0% ... 3.7% (3.7%) |
⬆️ |
| operator/cmd/cilium-crds/lifecycle.go | 0.0% ... 100.0% (100.0%) |
⬆️ |
| pkg/controllers/daemon/nodereconciler/node_controller_linux.go | 0.0% ... 12.5% (12.5%) |
⬆️ |
| operator/cmd/cilium-crds/root_linux.go | 0.0% ... 5.04% (5.04%) |
⬆️ |
Decreased diff
| Impacted Files | Coverage | |
|---|---|---|
| pkg/controllers/operator/retinaendpoint/retinaendpoint_controller.go | 83.28% ... 82.25% (-1.03%) |
⬇️ |
Quang Nguyen (nddq)
force-pushed
the
deps/cilium-1.20
branch
from
August 7, 2026 20:17
0fdfd7c to
4763faf
Compare
Quang Nguyen (nddq)
marked this pull request as ready for review
August 7, 2026 20:55
Quang Nguyen (nddq)
requested review from
Alexander (QxBytes) and
Ritwik Ranjan (ritwikranjan)
August 7, 2026 20:55
Quang Nguyen (nddq)
force-pushed
the
deps/cilium-1.20
branch
2 times, most recently
from
August 7, 2026 21:23
4260814 to
9a60559
Compare
Cilium v1.20 repurposed pkg/datapath/types into generated BPF C bindings and moved every Go interface it held into per-subsystem packages, so this bump needs code changes rather than a go.mod edit alone. It also pulls k8s.io/* 0.35.x -> 0.36.3, controller-runtime 0.23.3 -> 0.24.1, cilium/ebpf 0.21.0 -> 0.22.0, cilium/statedb 0.5.6 -> 0.8.3, cilium/hive -> v1.0.4, and controller-tools 0.19.0 -> 0.20.1. Track the moved APIs: datapath.NodeHandler -> node.Handler, datapath.IptablesManager -> iptables.Manager, datapath.IPsecConfig -> ipsectypes.Config, wgtypes.WireguardConfig -> wgtypes.Config, and daemonk8s.PodTableCell/NamespaceTableCell -> pkg/k8s/tables. The monolithic pkg/datapath/fake/types split into per-subsystem fake packages. PolicyRepository swapped GetSelectorPolicy for ComputeSelectorPolicy, and LocalNodeSynchronizer gained WaitForNodeInformation. CiliumSlimEndpointResource's second parameter was an ignored _ *node.LocalNodeStore in v1.19, so Retina passed nil. v1.20 added a localNode indexer that reads it on every CiliumEndpoint add, which panics the informer and crash-loops the agent. Pass the real store, plus the Logger and MetricsProvider fields that were also left nil. Fix two defects in the node handler registry that v1.20's hubble peer service makes reachable (it subscribes one handler per gRPC Notify stream): Subscribe wrote the handlers map under RLock, so two concurrent peer streams crash the agent with concurrent map writes; and the map was keyed by Name(), which every peer handler reports as the constant "hubble-peer", so a second stream evicted the first and the departing stream's Unsubscribe deafened the survivor. Key the set by handler identity, matching upstream's nodeManager, and lock exclusively. A regression test covers both under -race. On the operator, auth.Cell gained a ztunnel.Config dependency that fails DI resolution at startup, so provide DefaultConfig with ztunnel disabled. operatorMetrics.SharedConfig and endpointgc.SharedConfig.Interval are gone because those cells now own --enable-metrics and --cilium-endpoint-gc-interval through cell.Config, so drop the duplicate registrations. Leader-election flag names and config fields are no longer exported from operator/option; declare them locally under the same names and defaults so existing operator configuration keeps working. With those readers gone nothing consumes *operatorOption.OperatorConfig, so drop its provider and Populate call. Align the WithLeaderLifecycle copy with upstream v1.20 by also decorating job.Registry, so leader-scoped cells that adopt job.Group attach jobs to the post-election lifecycle, and move the registerOperatorHooks invoke to the end of the module per upstream's ordering requirement. v1.19's watcher constructors took an agentK8s.Resources bundle struct, which forced every field in it to be resolvable and is why Retina carried 20 no-op DI providers. v1.20 rewrote those constructors to depend on narrow types, leaving 12 of the providers and all of NoOpPolicyRepository unreachable. Remove them, and add tests that resolve both the agent and operator hives so a newly required provider fails in CI rather than on a cluster. Regenerate the CRDs with controller-gen v0.20.1: an annotation bump on all four and one property reorder in retina.sh_captures.yaml, no schema change. Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
Quang Nguyen (nddq)
force-pushed
the
deps/cilium-1.20
branch
from
August 7, 2026 21:25
9a60559 to
1701e50
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bumps
github.com/cilium/ciliumv1.19.3→v1.20.0, which transitively pullsk8s.io/*0.36.3,controller-runtime0.24.1,cilium/ebpf0.22.0,cilium/statedb0.8.3, andcilium/hivev1.0.4. Retina embeds part of Cilium's Hive graph for Hubble flow enrichment, and v1.20 repurposedpkg/datapath/typesinto generated BPF bindings, so the bump needs code changes:datapath.NodeHandler→node.Handler,datapath.IptablesManager→iptables.Manager, the datapath config interfaces → per-subsystemtypes.Config,pkg/datapath/fake/types→ per-subsystemfakepackages,daemonk8stable cells →pkg/k8s/tables.CiliumSlimEndpointResourcereads the previously-ignored*node.LocalNodeStoreparam in a new indexer, so thenilRetina passed panics the informer on the first CiliumEndpoint. Pass the real store, plus theLoggerandMetricsProviderfields that were also unset.Subscribewrote the handlers map underRLock(concurrent streams crash the agent), and keying byName()— constant"hubble-peer"for every peer handler — let a second stream evict the first. Key by handler identity under an exclusive lock, matching upstream.ztunnel.Configthatauth.Cellnow requires (disabled default); drop theSharedConfigproviders for flags the metrics and endpoint-GC cells now own viacell.Config, and the then-unconsumed*operatorOption.OperatorConfigprovider; declare the leader-election flags locally (same names and defaults) sinceoperator/optionstopped exporting them; alignWithLeaderLifecycleandregisterOperatorHooksordering with upstream v1.20.agentK8s.Resourcesbundle, leaving 12 of Retina's 20 no-op providers and all ofNoOpPolicyRepositoryunreachable. Removed — net-86lines of non-test code.controller-genv0.20.1; annotation bump only, no schema change.Related Issue
N/A.
Checklist
git commit -S -s ...). See this documentation on signing commits.Screenshots (if applicable) or Testing Completed
New
TestAgentHiveResolves/TestOperatorHiveResolvesresolve both hives at test time, so a Cilium bump that adds a required provider fails in CI instead of crash-looping on a cluster (theauth.Cellchange in this bump is exactly that class). The race test fails withDATA RACEwhen theSubscribefix is reverted.Deployed to a 2-node AKS cluster (k8s
1.35.6): zero restarts across agent, operator, and relay; flows enrich with pod identity and L7 DNS; eBPF plugins load underebpfv0.22.0with all metric families exporting. The handler-registry fixes were exercised directly — two relay replicas hold concurrent peer streams and both receive both peers, killing one relay leaves the survivor serving flows from both nodes, and three relay restart cycles plus an agent-pod kill produce no restarts orconcurrent maperrors.Upgrade path: installed released
retina-hubblev1.2.3(pinscilium v1.19.3), thenhelm upgraded to these images. Rollout clean, and the Cilium CRD specs hash identically before and after, so v1.20 accepts CRDs a v1.19 operator created. Also validated withhubble.tls.enabled=true.Additional Notes
N/A.