cilium / cilium / 39286 / 3
39%
master: 39%

DEFAULT BRANCH: master
Ran
Files 910
Run time 5min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 35.074% (+0.003%) from 35.071%
RACE=1 BASE_IMAGE=quay.io/cilium/cilium-runtime:514cbfc3fccb32fb67193b4b686f508b2fa26621@sha256:30cf45c1feadd04d367c446d0a3e3530d85be1b1e86f166f2862fdc09950f6a0 LOCKDEBUG=1

push

travis-ci-com

joestringer 
ipcache: Use incremental policy updates

Previously, this kube-apiserver code would trigger policy updates
globally with no synchronization to the policymap updates. This would
ensure a full re-evaluation of the policy for all endpoints, rather than
just targeting the policy updates that need to occur as a result of the
ipcache metadata injection (for associating the kube-apiserver label
with specific IP addresses).

Reuse EndpointManager.UpdatePolicyMaps() to ensure synchronous updates
of the underlying BPF policymaps, which should improve the ability to
consistently apply policy whenever there is an update involving the
kube-apiserver (for instance, if it moves to another node).

This will also serve as a basis to improve more general metadata
association with addresses as planned in upcoming changes.

Note that this will change the locking behaviour where previously, this
critical section would only synchronize the SelectorCache while holding
the IPcache, and asynchronously update the datapath. Now, policy map
updates for each endpoint will be performed while holding the IPcache
lock. This includes potentially updating the proxy policy.

Signed-off-by: Joe Stringer <joe@cilium.io>

44843 of 127852 relevant lines covered (35.07%)

2291.17 hits per line

Source Files on job 39286.3 (RACE=1 BASE_IMAGE=quay.io/cilium/cilium-runtime:514cbfc3fccb32fb67193b4b686f508b2fa26621@sha256:30cf45c1feadd04d367c446d0a3e3530d85be1b1e86f166f2862fdc09950f6a0 LOCKDEBUG=1)