Proto commits in projectcalico/calico

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2025-05-05

Do not use redirect_peer when sending packets to kubevirt VMs (#10308) * Avoid redirect_peer when sending packets to a vm workload. * Rename flags * Remove debug prints * Address review comments

The documentation is generated from this commit.

2025-03-26

Add ability to filter flows by policy name (#10067) * Add ability to filter by policy name * Add tests, reuse code between policy type filters

Add ability to filter flows by policy name (#10067) * Add ability to filter by policy name * Add tests, reuse code between policy type filters

2025-03-25

Add pagination for retrieving hints and flows, remove streaming from flows and hints list endpoints (#10024) This commit adds pagination for listing flows and hints. It removes the grpc streaming interfaces for these, as it's not compatible with pagination. If / when we need to provide the ability for streaming large chunks of data, we'll add some other interface to do so.

Add pagination for retrieving hints and flows, remove streaming from flows and hints list endpoints (#10024) This commit adds pagination for listing flows and hints. It removes the grpc streaming interfaces for these, as it's not compatible with pagination. If / when we need to provide the ability for streaming large chunks of data, we'll add some other interface to do so.

2025-03-21

Support nested BGP peering of calico-node (#9875)

2025-03-19

Fix typo (#10012)

2025-03-17

Add FilterTypeUnspecified for goldmane filter hints (#9993) * Add FilterTypeUnspecified for goldmane filter hints

2025-03-10

Clarify name field

2025-03-04

Goldmane gRPC API optimizations (#9919)

2025-03-03

Policy statistics API + implementation (#9834)

2025-02-13

Program routes for VXLAN tunnel IPs assigned from /32 or /128 blocks (#9698)

2025-02-12

Add support for end of tier policies, kbanp to policy hit struct (#9814)

2025-02-08

Goldmane API updates (#9784)

2025-01-31

[CORE-10973] Add QoSControls to WorkloadEndpoint (#9744) * [CORE-10973] Add QoSControls to WorkloadEndpoint Parsed from annotations: - qos.projectcalico.org/ingressBandwidth: - qos.projectcalico.org/egressBandwidth: - qos.projectcalico.org/ingressBurst: - qos.projectcalico.org/egressBurst: - qos.projectcalico.org/ingressPacketRate: - qos.projectcalico.org/egressPacketRate: - qos.projectcalico.org/ingressConnections: - qos.projectcalico.org/egressConnections: Also honor the k8s bandwidth plugin annotations if present (with native Calico annotations taking precedence): kubernetes.io/ingress-bandwidth: kubernetes.io/egress-bandwidth: * add default burst values, adjust validation * Address review comments: use min/max values when outside of range, move constants, use type alias for struct. * fix conversion test

2025-01-29

Support for Flow streaming in Goldmane (#9764)

2025-01-24

Refactor internals of Goldmane (#9745)

2025-01-22

Adding flow log support (#9737)

2025-01-21

Add initial flow aggregation code and API (#9708)

2025-01-08

Merge pull request #9662 from caseydavenport/casey-vxlan-borrow (#9685) Program connected routes for borrowed VXLAN tunnel addresses

2025-01-02

Calculate which routes are borrowed in route resolver. Add new Borrowed flag to protobuf so dataplane can tell which routes are borrowed.

2024-12-23

Replace gogoprotobuf with golang protobuf (#8949) * Use google.golang.org/protobuf github.com/gogo/protobuf is deprecated [1] so use the official protobuf. [1] https://twitter.com/awalterschulze/status/1584553056100057088 * updated ID types for mock dataplane * convert proto type IDs to be valid map keys * solved copylocks warning by passing proto type reference * make all processor unit tests passed * convert proto types for app-policy * convert proto types for mock dataplane * addressed hjiawei's comments * make all TestCalculationGraph unit tests passed * fixed linter copylocks issues part 1 * fixed linter copylocks issue part 2 * replace deprecated grpc.Dial by grpc.NewClient * resovled conflict issues due to rebase * set default resolver scheme passthrough before grpc.NewClient for UNIX socket * Re-generate protobuf and cleanup go.mod * fixed syncserver_test and policysync_test issues * fixed policysync_test nsID issue * addressed hjiawei's comments * addressed hjiawei's comments: updated file names * fixed policysync_test which tried to compare two proto objs by using Expect/Equal * fixed static checks ineffectual assignment for equal * fixed policysync_test index value issue * fixed the panic issue when proto.RouteUpdate try to access Type * addressed hjiawei's comment: should use Eventrually for async assertion * Use one line Expect googleproto equal to be true * Add Expect assertion * Move grpc resolver SetDefaultScheme to init func * Fix app-policy checker unit tests * Fix felix calc state unit tests * Add protobuf target for pod2daemon and remove SKIP_PROTOBUF flag * Fix go import format * Use make fix-changed to reformat generated go files * Revert back to make fix for api * Update go mod * Fix felix untracked policy unit tests --------- Co-authored-by: Jiawei Huang <jiawei@tigera.io>

2024-09-18

Merge pull request #9232 from mazdakn/tier-action Introduce default action in tiers

2024-09-17

Change

2024-09-16

Allow users to set the default action in a tier

2024-07-24

Add v4 and v6 routes for UDP service when in dual stack mode.

2024-07-23

Add v4 and v6 routes for UDP service when in dual stack mode.

2024-06-28

import protobuf from felix, keep healthz only

2024-03-11

Adds endpoint-status file-writing and endpoint-status CNI waiting (#8469) CNI plugin can now delay pod startup until Felix has finished programming the dataplane.

2023-12-20

Group common sub-sequences of policies into shared iptables chains (#8098) Group policies in iptables chains based on the selectors used in the policies. For example, if there are three policies in a row that use the same selector, put them in a group. - Add protobuf field for policy selector pass through from calc graph. - Add policy group calculation to endpoint manager. Does refcounting to manage shared policy group chains. - Add policy group chain rendering to rule renderer. Take advantage of extra indirection to implement pass rules more efficiently (return on pass or accept). - Make iptables reference counting recursive. Instead of refcounting blindly, trigger incref of children only when the chain itself becomes referenced. Trigger decref only for referenced chains. Only invalidate dataplane if changing a referenced chain. CORE-10015

2022-12-09

Merge remote-tracking branch 'origin/master' into tune-liveness

2022-12-08

add info to hostmetadataupdate

2022-12-06

Improve determination of no-restart config params - Fix calculation of field changes. Reset values to defaults Compare the post-parse values. - Use the real config object to determine what's changed instead of using the raw values. - Refactor to put handling of daemon-owned params in one place.

2022-12-05

Add Felix HealthTimeoutOverrides config parameter. Allows for any liveness/readiness timeout to be overridden in an emergency.

2022-10-03

felix: service ports part of ServiceUpdate

2022-09-08

Revert unnecessary addition to datamodel

Always program OpenStack floating IPs Felix's programming of NAT mappings was disabled by default in https://github.com/projectcalico/calico/pull/5861. This was a security fix for Kubernetes, as in Kubernetes anyone could create a floating IP for themselves by adding a "floatingips" annotation to their own pods. For OpenStack, pod annotations obviously do not apply, and NAT mappings come from the ML2 driver running as part of the Neutron server, which is already access-protected in an appropriate way. And we don't want to have to document that OpenStack users need to add "FloatingIPs = Enabled" to their felix.cfg file. Therefore, arrange for OpenStack-configured floating IPs to be programmed regardless of the FloatingIPs setting in FelixConfiguration.

2022-08-18

add info to ipampool message in felix

2022-08-10

support multinet for calicovpp by adding annotations to wep

2022-07-22

Add wireguard IPv6 support (#6178)

2022-05-05

Automated cherry pick of #6025: Only filter by OIF if an interface index was given (#6028) * Only filter by OIF if an interface index was given * Handle IPv4 and IPv6 VXLAN enablement separately * Add encap resolver UTs * Alternative fix for IPv6 blackholes * Fix calc graph FV for v6 VXLAN enablement

IPv6 VXLAN: Decouple v4 / v6 VXLAN enablement, fix route programming loop for IPv6 blackholes (#6025) * Only filter by OIF if an interface index was given * Handle IPv4 and IPv6 VXLAN enablement separately * Add encap resolver UTs * Alternative fix for IPv6 blackholes * Fix calc graph FV for v6 VXLAN enablement

2022-04-22

Add option to selectively disable rpf check for workloads (#5742) * Add option to selectively disable iptables rpf check This feature is controlled by a felix configuration parameter: WorkloadSourceSpoofing It currently has 2 possible values: - Disabled (default): maintain current behaviour, pods cannot spof their IP - Any: pods can ask to send packets from any address A pod can request IP address spoofing with the following annotation: cni.projectcalico.org/allowedSourcePrefixes The value should be a JSON array of CIDRs that the pod wants to use as source, for instance: cni.projectcalico.org/allowedSourcePrefixes: "[\"10.96.100.0/24\", \"1.2.3.4/32\"]" This feature is currently only implemented in the iptables dataplane. * Fixes for rpf-skip feature Use a flag to update the chain only once in CompleteDeferredWork() Remove annotation parsing in the CNI code Fix defaultRpFilter capitalization

2022-04-21

Add IPv6 handling to the VXLAN manager (#5932)

2022-04-15

[IPv6 VXLAN] Add IPv6 support to vxlanResolver Update proto.VXLANTunnelEndpointUpdate to contain both IPv4 and IPv6 VTEP information. Add IPv6 support to vxlanResolver (along with refactors for correct behavior when either IPv4, IPv6 or both IPv4+IPv6 information is present). Add calc_graph_fv states for IPv6 VXLAN and IPv4+IPv6 VXLAN coverage of these changes.

2022-04-06

Fix external dataplane with new Service messages (#5842) * Fix ext dataplane with new Service messages * Add tests for dataplane passthru, test that the external dataplane can wrap all messages * Fix error message formatting

2022-04-01

felix: Add Service update to calc

2022-03-30

Have Felix use IP pools to determine enabled encaps Mark IpInIpEnabled and VXLANEnabled as deprecated with comments and make them pointers in config_params.go to match FelixConfiguration, to make it possible to distinguish an 'unset' nil value from an explicitly disabled false. Add Encapsulation struct to config_params.go which contains the calculated IPIPEnabled and VXLANEnabled parameters that represent whether these encaps are effectively enabled or not. Add EncapsulationResolver to calc graph which will watch the IP pools and send an Encapsulation protobuf message to the dataplane when IP pool encapsulations change. The dataplane will restart Felix if there are IPIP and/or VXLAN changes (so that the encaps are recalculated and applied) when receiving a proto.Encapsulation message in sendMessagesToDataplaneDriver() in daemon.go. Also add support for exiting cleanly on reasonEncapChanged to monitorAndManageShutdown() in daemon.go. Add EncapsulationCalculator helper struct, used by Run() in daemon.go and by EncapsulationResolver. It calculates whether the encaps should be enabled based on the existing IP pools and FelixConfiguration. Add support for Encapsulation in the form of OnEncapUpdate() and flushEncapUpdate() to event_sequencer.go. Add retry mechanism to cleanUpVXLANDevice() and make it run in a goroutine so it doesn't block Felix. Also add cleanUpIPIPAddrs() to clean up IP addresses from the tunl0 interface when IPIP encapsulation is implicitly disabled, i.e., unset in FelixConfiguration and there are no IPIP pools. Add *bool parsing support to param_types.go. Add encapsulation_resolver_test.go UTs to test EncapsulationResolver and EncapsulationCalculator exhaustively. Add encapsulation support and test cases to calc_graph_fv_test.go. Update mtu_test.go to include a case for testing MTU settings based on the enabled IP pools. Update docs accordingly. Update description for IPIPEnabled and VXLANEnabled in FelixConfig CRDs

2021-12-15

cni: pass grpc dataplane options to the actual dataplane

2021-12-14

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit ebb83b8c009a5bd5d2919488c361a82d596105ee.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit 5608d2e70664e5d4110e8c4b93297b130b85643d.

Move app-policy into its own directory. To see the pre-monorepo history follow commit e3b341a2e96e33f55f57a68bc7cea0b24c0fe822.

Move felix into its own directory. To see the pre-monorepo history follow commit 166ce800138f3f62b5ec483bf296346589cbb538.

Create combined release-v3.21 branch, step merge-base-os-release-v3.21-pvt-release-calient-v3.11. - calico: 53ff1515edce0a52b40236a09ee3e3d95cf393f6 - node: 6d3c8d5fc215782c80d2661d98cb36f9242cc3a8 - felix: 6ea91fd7b4f8065817c7430d823bb85806d6c29e - typha: cd940c2b6754686f5890f4f4890bb8a1622c1460 - calicoctl: 7615d6116888630d595b96b153382f26af326e90 - cni-plugin: 8f15d45eda1a935079b04bd9fa93e707e6fd4bf0 - libcalico-go: beaac407f6d42049dc5e511cc86f6245923c72c4 - pod2daemon: 9211fdf34b19d6fa5c5970a7f69fe747e0ec06ee - app-policy: c1cf86d62e57ec1c9ff91778343f8570801d74ad - kube-controllers: 71db72200b214df6e09643672193dd8fba8cc987 - confd: c654a410005bb3bfa2d0cbbf5b75ae496a82ea03 - networking-calico: cf71e7188ed53705aa6a627df7b3ea46d251aac0 - apiserver: fd692637d0eefd4a2b284112261be7617b0512e3 - api: 7e6e4eceaf6a377cfc9cfce8e1a16320d5e6b56f

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit ebb83b8c009a5bd5d2919488c361a82d596105ee.

Move app-policy into its own directory. To see the pre-monorepo history follow commit 92de13cc1b93d3173ef90cc364a6f396cb147cf8.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit ff26af58ddb503b7969e7dec3ec84f274d588d37.

Move felix into its own directory. To see the pre-monorepo history follow commit 4b1633af321f2b8c9ffe033b6da3f12053b594da.

Move app-policy into its own directory. To see the pre-monorepo history follow commit 71b61b5f408d00c17651982d6582a512b6e4bb2b.

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit b3a8b892d1148f00ad52724b638eb90b17f39648.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit 150541d1c6c67e416763c180adfd7dc8d695287a.

Move felix into its own directory. To see the pre-monorepo history follow commit d4f9b4cb185d134dc0bcccb6e272a192ce865ad6.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit becfea1e40ee2e751096ad45bb43d3df92ee7931.

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit b3a8b892d1148f00ad52724b638eb90b17f39648.

Move app-policy into its own directory. To see the pre-monorepo history follow commit 856e2357c886abd3f5fbdc1c6a13d92110b54d7f.

Move felix into its own directory. To see the pre-monorepo history follow commit 92e1804e74ad1c4448d72c868df7c7e8e19f0cf3.

Create combined release-v3.20 branch, step merge-base-os-release-v3.20-pvt-release-calient-v3.9. - calico: 0f16243e9dc5dfdfdb53ce73d55da484182746aa - node: a7a05c71b68ec831303aedd05073fd128a472629 - felix: cf89c4ccd9562636b3294579ba47d51935b6d25c - typha: 7e0d45fecc57a5052df7375abd95aea07adc25f5 - calicoctl: 91c0e6e9517f4292a62fc3fc604f299f88625d76 - cni-plugin: b44d52be8356d3bf16775201b7a05fee92a91442 - libcalico-go: cc57018d03a40b59eaa4f2259524c66dab1a0c50 - pod2daemon: ef1edafda2f7a7374549b0a419125f122af9b850 - app-policy: 433602f3ebe4dbffd140771a18cfe17e913e4271 - kube-controllers: e26565750f2dba575a63f64b51bd1d49e9870966 - confd: fda94dd0edad60693b2b8e38223cd19f97b68d76 - networking-calico: 7a5b191702d7fdcd3c777cecba7d2954b7aac5c7 - apiserver: a14c0401d3fe5b235af1efe6a523995d9006022e - api: 2262d0fbdd4ce8eb6bb49f9578cd4bea0ad7060c

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit b3a8b892d1148f00ad52724b638eb90b17f39648.

Move app-policy into its own directory. To see the pre-monorepo history follow commit 856e2357c886abd3f5fbdc1c6a13d92110b54d7f.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit becfea1e40ee2e751096ad45bb43d3df92ee7931.

Move felix into its own directory. To see the pre-monorepo history follow commit 92e1804e74ad1c4448d72c868df7c7e8e19f0cf3.

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit 3675ca99f66eeede9fe2caf648526928146c7608.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit 81a977f4a476ad3b156cd36a9079e494585889f4.

Move app-policy into its own directory. To see the pre-monorepo history follow commit 6a5131a8f2a436da015885508a2d4281e3ad7237.

Move felix into its own directory. To see the pre-monorepo history follow commit 375ede0e6609df66f85dae0af3e650d583154e56.

Create combined master branch, step merge-base-os-master-pvt-master. - calico: 9ef4d4d8d40d4386c3139be59fff3497799c1138 - node: c7eb8cc35060f41d043f4f928b3d3afcca88970e - felix: 9673cc9500c1614f2d24df7b7e555a3e517dbc5c - typha: cad46f4934d5ff4168ebf1fe507165b8c7b437c6 - calicoctl: ecef15e1b44538eb15dfa2eca222c83e1b10d666 - cni-plugin: a14148a3b347c9ac7e2b50cc98594bf89aa649c5 - libcalico-go: 387e0c2ea1292cf7a5a0449bfc6adb7f33636ad4 - pod2daemon: 7515892af6737ce56af00974a3760e48e61a861c - app-policy: 798d6def68c4895f8c8a4e9b00435c85a286657b - kube-controllers: 5cb35727a2722d49f8fb80d47f930bdf7aa650f9 - confd: 72ff41b97f099e8b9bff18e10f787e2b934aa9b6 - networking-calico: cd3fca0cc99f92826d329d514f1d538448688487 - apiserver: 895e6ac80aefadbb3f39ed9ff9fb387651917c37 - api: 17c9924127d084ceda8de2762e982430d45d1ba3

Move pod2daemon into its own directory. To see the pre-monorepo history follow commit 3675ca99f66eeede9fe2caf648526928146c7608.

Move app-policy into its own directory. To see the pre-monorepo history follow commit 508c10f5f857e67f8fbdc25a39ba624cc34d4761.

Move cni-plugin into its own directory. To see the pre-monorepo history follow commit 81a977f4a476ad3b156cd36a9079e494585889f4.

Move felix into its own directory. To see the pre-monorepo history follow commit 3483e644afd512243eb19b8e6da5448def0b7d1e.

2021-10-25

Add support for services in ingress rules

Add support for services in ingress rules

2021-09-10

Add hostports to gRPC dataplane

2021-07-26

Automated cherry pick of #2874: Add ServiceIndex component, handle service rules (#2916)

Add ServiceIndex component (#2874)

2021-04-29

Service loop prevention for LoadBalancer IPs (#2798)

2021-02-26

Service loop prevention for external IPs

2020-10-19

Define proto.GlobalBGPConfigUpdate

Code review markups

2020-06-11

Include wireguard tunnel IP address in wireguard routing

2020-05-01

Only route to wireguard for workload-originated flows

Only route to wireguard for workload-originated flows

2020-04-28

Wireguard implementation

2020-04-07

Add local WEPs to trie.

2020-04-03

Fix up protobuf naming convention.

2020-04-02

Add dataplane interface and gRPC dataplane (#859) * Add dataplane interface and gRPC dataplane * Move dataplane/ to pkg/ * Move desired host side veth name computation out of the linux dataplane. This ensures all dataplanes will use the same value. * Add dataplane tests * Rename interface_name to host_interface_name in grpc proto * Pass workload info to the dataplane

Rework routing calculation so that l3 resolver calculates all the routes. - Add pool metadata to the routes for BPF dataplane. - Send routes even if VTEP etc isn't ready (for the BPF dataplane). - VXLAN manager cactually handles out-of-order VTEPs already. - Handle lack of node IP in BPF route manager. - Ignore IPv6 inputs to route calculation. - Include some calc graph FV tests for the v3 validator.

2020-02-24

Merge remote-tracking branch 'open-source/master' into HEAD

Plumb through route updates.

Add remote hosts and workloads to the route map.