Merge pull request #956 from l1b0k/main

fix trunk issue and bump cilium to v1.16.18

Author: BSWANG

deploy/images/policy/Dockerfile

@@ -22,7 +22,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     ( ! $(readelf -d bin/calico-felix | grep -q NEEDED) || ( echo "Error: bin/calico-felix was not statically linked"; false )) \
     && chmod +x /go/src/github.com/projectcalico/calico/bin/calico-felix
 
-FROM --platform=$TARGETPLATFORM quay.io/cilium/cilium-builder:0aa9ec56fe2df313baa592994c1e4dd2a6a38f96@sha256:d5df105dbf3362be00cb88ba8f517d54b3a272e71f7b3e9be38690b48e23149e as cilium-builder
+FROM --platform=$TARGETPLATFORM quay.io/cilium/cilium-builder:03739b8b3d9bcfd05501f61d035f6b027e4c9425@sha256:01cdf345f1aa673c073fdf7f59a78c58eff9974c940d81cfd2286aba890da841 as cilium-builder
 ARG GOPROXY
 ENV GOPROXY=$GOPROXY
 ARG CILIUM_SHA=""
@@ -31,8 +31,8 @@ LABEL cilium-sha=${CILIUM_SHA}
 LABEL maintainer="[email protected]"
 WORKDIR /go/src/github.com/cilium
 RUN rm -rf cilium
-ENV GIT_TAG=v1.16.12
-ENV GIT_COMMIT=a66093957f9614320e5d7364615235209b757c55
+ENV GIT_TAG=v1.16.18
+ENV GIT_COMMIT=ab50022137f1d6af6914dead0d83b13ab3119d4d
 RUN git clone -b $GIT_TAG --depth 1 https://github.com/cilium/cilium.git && \
     cd cilium && git config --global user.email terway && git config --global user.name terway && \
     [ "`git rev-parse HEAD`" = "${GIT_COMMIT}" ]

deploy/images/terway-controlplane/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1-labs
-ARG TERWAY_POLICY_IMAGE=registry-cn-zhangjiakou.ack.aliyuncs.com/acs/terway:policy-71baf890@sha256:20e5741a0ad2dc4358ade7a8d41ebf192e6804bff94da95f34f1be7397b3cf4e
+ARG TERWAY_POLICY_IMAGE=registry-cn-zhangjiakou.ack.aliyuncs.com/acs/terway:policy-2a808777@sha256:12efe4848968aaa864c6dc3b152aed44589928c581c9659bba30b044c1c92897
 
 FROM --platform=$TARGETPLATFORM ${TERWAY_POLICY_IMAGE} AS policy-dist
 

deploy/images/terway/Dockerfile

@@ -1,15 +1,13 @@
 # syntax=docker/dockerfile:1-labs
-ARG TERWAY_POLICY_IMAGE=registry-cn-zhangjiakou.ack.aliyuncs.com/acs/terway:policy-71baf890@sha256:20e5741a0ad2dc4358ade7a8d41ebf192e6804bff94da95f34f1be7397b3cf4e
+ARG TERWAY_POLICY_IMAGE=registry-cn-zhangjiakou.ack.aliyuncs.com/acs/terway:policy-2a808777@sha256:12efe4848968aaa864c6dc3b152aed44589928c581c9659bba30b044c1c92897
 ARG UBUNTU_IMAGE=registry.cn-hangzhou.aliyuncs.com/acs/ubuntu:24.04-update
-ARG CILIUM_IPROUTE2_IMAGE=quay.io/cilium/cilium-iproute2:3570d58349efb2d6b0342369a836998c93afd291@sha256:1abcd7a5d2117190ab2690a163ee9cd135bc9e4cf8a4df662a8f993044c79342
-ARG CILIUM_LLVM_IMAGE=quay.io/cilium/cilium-llvm:02191b3a68f4003f075e69a61b61faa8d12d4b6d@sha256:54ca04f65a6de3aa5243a7da392aed342c64f579ebd94ea1290590ce77a433a8
-ARG CILIUM_BPFTOOL_IMAGE=quay.io/cilium/cilium-bpftool:5a9c4852a21287686009bfe1cdc1fed6e7aabdea@sha256:188e398ee30456373530698d0d29de66dda0c4428068ea430027ceb7e9c15b7c
-ARG CILIUM_IPTABLES_IMAGE=quay.io/cilium/iptables:1331e9b1b03f70c9d8b08626d9a7126963f86478@sha256:d761d967243aced2729adde1e332a9c9def6baeb61f5f6cde5758b04e9a79355
+ARG CILIUM_LLVM_IMAGE=quay.io/cilium/cilium-llvm:9f1bfe736009afb1fbb562718bbc42ea07d37d8e@sha256:a666a7a01a2dc610c3ab6e32f25ca5e294201f3cbbc01f233320c527955deee3
+ARG CILIUM_BPFTOOL_IMAGE=quay.io/cilium/cilium-bpftool:0db3a73729ceb42e947d826bb96a655be79e5317@sha256:de23c9546c4eafab33f75d6f5d129947bbbafc132dbd113c0cecc9a61929e6b0
+ARG CILIUM_IPTABLES_IMAGE=quay.io/cilium/iptables:67f517af50e18f64cd12625021f1c39246bb4f92@sha256:d075f03e89aacf51908346ec8ed5d251b8d3ad528ce30a710fcd074cdf91f11d
 
 FROM --platform=$TARGETPLATFORM ${TERWAY_POLICY_IMAGE} AS policy-dist
 FROM --platform=$TARGETPLATFORM ${CILIUM_LLVM_IMAGE} AS llvm-dist
 FROM --platform=$TARGETPLATFORM ${CILIUM_BPFTOOL_IMAGE} AS bpftool-dist
-FROM --platform=$TARGETPLATFORM ${CILIUM_IPROUTE2_IMAGE} AS iproute2-dist
 FROM --platform=$TARGETPLATFORM ${CILIUM_IPTABLES_IMAGE} AS iptables-dist
 
 FROM --platform=$BUILDPLATFORM golang:1.25.5 AS builder
@@ -32,7 +30,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     go build -tags default_build -ldflags "-s -w" -o terway-cli ./cmd/terway-cli
 
 FROM --platform=$TARGETPLATFORM ${UBUNTU_IMAGE}
-RUN apt-get update && apt-get install -y kmod libelf1 libmnl0 iptables nftables kmod curl ipset bash ethtool bridge-utils socat grep findutils jq conntrack iputils-ping && \
+RUN apt-get update && apt-get install -y iproute2 kmod libelf1 libmnl0 iptables nftables kmod curl ipset bash ethtool bridge-utils socat grep findutils jq conntrack iputils-ping && \
     apt-get purge --auto-remove && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 RUN --mount=type=bind,from=iptables-dist,source=/iptables,target=/iptables \
@@ -42,8 +40,6 @@ RUN --mount=type=bind,source=/hack/iptables-wrapper-installer.sh,target=/iptable
 
 COPY --link --from=llvm-dist /usr/local/bin/clang /usr/local/bin/llc /usr/bin/
 COPY --link --from=bpftool-dist /usr/local /usr/local
-COPY --link --from=iproute2-dist /usr/local /usr/local
-COPY --link --from=iproute2-dist /usr/lib/libbpf* /usr/lib/
 COPY --link --from=policy-dist /bin/calico-felix /usr/local/bin/calico-felix
 
 COPY --link ../../../policy/policyinit.sh ./../../policy/uninstall_policy.sh ../../../hack/init.sh /usr/bin/

policy/cilium/0001-cni-add-terway-cni.patch

@@ -660,7 +660,7 @@ index 07b6afca7c..fd69aab5e6 100644
  	}
  }
 diff --git a/pkg/endpoint/endpoint.go b/pkg/endpoint/endpoint.go
-index bba3bc2aed..ae7e11b752 100644
+index 72f0cbfbbc..063d6c4f58 100644
 --- a/pkg/endpoint/endpoint.go
 +++ b/pkg/endpoint/endpoint.go
 @@ -31,6 +31,7 @@ import (
@@ -671,7 +671,7 @@ index bba3bc2aed..ae7e11b752 100644
  	dptypes "github.com/cilium/cilium/pkg/datapath/types"
  	"github.com/cilium/cilium/pkg/defaults"
  	"github.com/cilium/cilium/pkg/endpoint/regeneration"
-@@ -429,6 +430,10 @@ type Endpoint struct {
+@@ -425,6 +426,10 @@ type Endpoint struct {
 
  	// NetNsCookie is the network namespace cookie of the Endpoint.
  	NetNsCookie uint64
@@ -682,7 +682,7 @@ index bba3bc2aed..ae7e11b752 100644
  }
 
  func (e *Endpoint) GetRealizedRedirects() (redirects map[string]uint16) {
-@@ -711,6 +716,9 @@ func (e *Endpoint) GetID16() uint16 {
+@@ -709,6 +714,9 @@ func (e *Endpoint) GetID16() uint16 {
  // In some datapath modes, it may return an empty string as there is no unique
  // host netns network interface for this endpoint.
  func (e *Endpoint) HostInterface() string {
@@ -692,7 +692,7 @@ index bba3bc2aed..ae7e11b752 100644
  	return e.ifName
  }
 
-@@ -2590,6 +2598,9 @@ func (e *Endpoint) Delete(conf DeleteConfig) []error {
+@@ -2589,6 +2597,9 @@ func (e *Endpoint) Delete(conf DeleteConfig) []error {
  // setDown sets the Endpoint's underlying interface down. If the interface
  // cannot be retrieved, returns nil.
  func (e *Endpoint) setDown() error {
@@ -794,7 +794,7 @@ index 0000000000..16d42d2e7b
 +	return ep.eniIndex
 +}
 diff --git a/pkg/option/config.go b/pkg/option/config.go
-index 0fbbdeb7f0..e38fd79cdb 100644
+index 41ce99326c..581382cacc 100644
 --- a/pkg/option/config.go
 +++ b/pkg/option/config.go
 @@ -40,6 +40,7 @@ import (
@@ -805,7 +805,7 @@ index 0fbbdeb7f0..e38fd79cdb 100644
  	"github.com/cilium/cilium/pkg/defaults"
  	"github.com/cilium/cilium/pkg/ip"
  	ipamOption "github.com/cilium/cilium/pkg/ipam/option"
-@@ -2574,7 +2575,8 @@ func (c *DaemonConfig) TunnelingEnabled() bool {
+@@ -2573,7 +2574,8 @@ func (c *DaemonConfig) TunnelingEnabled() bool {
  func (c *DaemonConfig) AreDevicesRequired() bool {
  	return c.EnableNodePort || c.EnableHostFirewall || c.EnableWireguard ||
  		c.EnableHighScaleIPcache || c.EnableL2Announcements || c.ForceDeviceRequired ||
@@ -1311,5 +1311,5 @@ index cd4b2f673e..fceb272841 100644
 
  // IPAM is the Cilium specific CNI IPAM configuration
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)
 

policy/cilium/0002-bypass-the-node-local-dns-ip.patch

@@ -32,5 +32,5 @@ index d8871026d5..f7b44be648 100644
  			ret = ipv4_l3(ctx, ETH_HLEN, NULL, NULL, ip4);
  			if (ret == CTX_ACT_OK)
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)
 

policy/cilium/0003-cep-optimize-cep-watch.patch

@@ -132,5 +132,5 @@ index ca0c3753c2..70abef8924 100644
 
  		if annotationsChanged {
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)
 

policy/cilium/0004-lb-enable-in-cluster-load-balancer.patch

@@ -61,7 +61,7 @@ index 486d4669c6..9e453da546 100644
  		k8sLoadBalancerIPs = parseIPs(loadBalancerIPs)
  	} else if option.Config.BGPAnnounceLBIP {
 diff --git a/pkg/option/config.go b/pkg/option/config.go
-index e38fd79cdb..854fd4abc5 100644
+index 581382cacc..d082a24585 100644
 --- a/pkg/option/config.go
 +++ b/pkg/option/config.go
 @@ -245,6 +245,9 @@ const (
@@ -84,7 +84,7 @@ index e38fd79cdb..854fd4abc5 100644
  	// EnableSVCSourceRangeCheck enables check of loadBalancerSourceRanges
  	EnableSVCSourceRangeCheck bool
 
-@@ -3053,6 +3059,7 @@ func (c *DaemonConfig) Populate(vp *viper.Viper) {
+@@ -3052,6 +3058,7 @@ func (c *DaemonConfig) Populate(vp *viper.Viper) {
  	c.EnableIPIPTermination = vp.GetBool(EnableIPIPTermination)
  	c.EnableUnreachableRoutes = vp.GetBool(EnableUnreachableRoutes)
  	c.EnableNodePort = vp.GetBool(EnableNodePort)
@@ -93,5 +93,5 @@ index e38fd79cdb..854fd4abc5 100644
  	c.EnableHostPort = vp.GetBool(EnableHostPort)
  	c.EnableHostLegacyRouting = vp.GetBool(EnableHostLegacyRouting)
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)
 

policy/cilium/0005-deprecated-disable-per-package-lb.patch

@@ -53,7 +53,7 @@ index 0db9f8a1fa..28ff4c121f 100644
  	cDefinesMap["HOST_ID"] = fmt.Sprintf("%d", identity.GetReservedID(labels.IDNameHost))
  	cDefinesMap["WORLD_ID"] = fmt.Sprintf("%d", identity.GetReservedID(labels.IDNameWorld))
 diff --git a/pkg/option/config.go b/pkg/option/config.go
-index 854fd4abc5..33d18ab335 100644
+index d082a24585..ab0731826c 100644
 --- a/pkg/option/config.go
 +++ b/pkg/option/config.go
 @@ -1233,6 +1233,8 @@ const (
@@ -65,7 +65,7 @@ index 854fd4abc5..33d18ab335 100644
  )
 
  // Default string arguments
-@@ -2435,6 +2437,8 @@ type DaemonConfig struct {
+@@ -2434,6 +2436,8 @@ type DaemonConfig struct {
  	// EnableSocketLBPodConnectionTermination enables the termination of connections from pods
  	// to deleted service backends when socket-LB is enabled
  	EnableSocketLBPodConnectionTermination bool
@@ -74,7 +74,7 @@ index 854fd4abc5..33d18ab335 100644
  }
 
  var (
-@@ -3171,6 +3175,8 @@ func (c *DaemonConfig) Populate(vp *viper.Viper) {
+@@ -3170,6 +3174,8 @@ func (c *DaemonConfig) Populate(vp *viper.Viper) {
  	c.BPFEventsTraceEnabled = vp.GetBool(BPFEventsTraceEnabled)
  	c.EnableIPSecEncryptedOverlay = vp.GetBool(EnableIPSecEncryptedOverlay)
 
@@ -84,5 +84,5 @@ index 854fd4abc5..33d18ab335 100644
  	switch c.ServiceNoBackendResponse {
  	case ServiceNoBackendResponseReject, ServiceNoBackendResponseDrop:
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)
 

policy/cilium/0006-gops-allow-disable-gops.patch

@@ -23,5 +23,5 @@ index 707835d816..0e2da2efa6 100644
  	addrField := logrus.Fields{"address": addr, logfields.LogSubsys: "gops"}
  	log = log.WithFields(addrField)
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)
 

policy/cilium/0007-ctmap-log-ct-gc-status.patch

@@ -39,5 +39,5 @@ index c4ebecc404..81555cfc8a 100644
  }
 
 -- 
-2.39.5 (Apple Git-154)
+2.50.1 (Apple Git-155)