ipsec: remove deprecated enable-ipsec-encrypted-overlay option

This is not used anymore. From Cilium >v1.18, all overlay traffic gets
automatically encrypted before leaving the host without needing any
agent/daemon/helm flags.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

Author: smagnani96

Documentation/helm-values.rst

@@ -385,6 +385,9 @@ from Cilium.
 * The previously deprecated ``--node-port-mode`` agent flag has been removed
   in favor of the ``--bpf-lb-mode`` (``loadBalancer.mode`` Helm value).
 
+* The previously deprecated and ignored ``--enable-ipsec-encrypted-overlay`` agent
+  flag (Helm ``encryption.ipsec.encryptedOverlay``) has been removed.
+
 Changes to Metrics
 ~~~~~~~~~~~~~~~~~~
 

Documentation/operations/upgrade.rst

@@ -747,7 +747,6 @@ data:
     {{- if .Values.encryption.ipsec.keyRotationDuration }}
   ipsec-key-rotation-duration: {{ include "validateDuration" .Values.encryption.ipsec.keyRotationDuration | quote }}
     {{- end }}
-  enable-ipsec-encrypted-overlay: {{ .Values.encryption.ipsec.encryptedOverlay | quote }}
   {{- else if eq .Values.encryption.type "wireguard" }}
   enable-wireguard: {{ .Values.encryption.enabled | quote }}
     {{- if .Values.encryption.wireguard.persistentKeepalive }}

install/kubernetes/cilium/README.md

@@ -1934,9 +1934,6 @@
         },
         "ipsec": {
           "properties": {
-            "encryptedOverlay": {
-              "type": "boolean"
-            },
             "interface": {
               "type": "string"
             },

install/kubernetes/cilium/templates/cilium-configmap.yaml

@@ -1180,8 +1180,6 @@ encryption:
     # -- Maximum duration of the IPsec key rotation. The previous key will be
     # removed after that delay.
     keyRotationDuration: "5m"
-    # -- Enable IPsec encrypted overlay
-    encryptedOverlay: false
   wireguard:
     # -- Controls WireGuard PersistentKeepalive option. Set 0s to disable.
     persistentKeepalive: 0s

install/kubernetes/cilium/values.schema.json

@@ -97,7 +97,6 @@ func (def UserConfig) Flags(flags *pflag.FlagSet) {
 	flags.Bool(option.EnableIPsecKeyWatcher, def.EnableIPsecKeyWatcher, "Enable watcher for IPsec key. If disabled, a restart of the agent will be necessary on key rotations.")
 	flags.Bool(option.EnableIPSecXfrmStateCaching, def.EnableIPsecXfrmStateCaching, "Enable XfrmState cache for IPSec. Significantly reduces CPU usage in large clusters.")
 	flags.MarkHidden(option.EnableIPSecXfrmStateCaching)
-	flags.MarkDeprecated(option.EnableIPSecEncryptedOverlay, "Encrypted overlay is the default behavior for IPsec.")
 	flags.Bool(option.UseCiliumInternalIPForIPsec, def.UseCiliumInternalIPForIPsec, "Use the CiliumInternalIPs (vs. NodeInternalIPs) for IPsec encapsulation")
 	flags.MarkHidden(option.UseCiliumInternalIPForIPsec)
 	flags.Bool(option.DNSProxyInsecureSkipTransparentModeCheck, def.DNSProxyInsecureSkipTransparentModeCheck, "Allows DNS proxy transparent mode to be disabled even if encryption is enabled. Enabling this flag and disabling DNS proxy transparent mode will cause proxied DNS traffic to leave the node unencrypted.")

install/kubernetes/cilium/values.yaml

@@ -53,7 +53,6 @@ func (a *Agent) Enabled() bool {
 
 type Config struct {
 	EnableIPsec                              bool
-	EncryptedOverlay                         bool
 	UseCiliumInternalIPForIPsec              bool
 	DNSProxyInsecureSkipTransparentModeCheck bool
 }

install/kubernetes/cilium/values.yaml.tmpl

@@ -135,10 +135,6 @@ const (
 	// ReservedIdentityWorldIPv6 represents any endpoint outside of the cluster
 	// for IPv6 address only.
 	ReservedIdentityWorldIPv6
-
-	// ReservedEncryptedOverlay represents overlay traffic which must be IPSec
-	// encrypted before it leaves the host
-	ReservedEncryptedOverlay
 )
 
 // Special identities for well-known cluster components
@@ -367,17 +363,16 @@ func GetMaximumAllocationIdentity(clusterID uint32) NumericIdentity {
 
 var (
 	reservedIdentities = map[string]NumericIdentity{
-		labels.IDNameHost:             ReservedIdentityHost,
-		labels.IDNameWorld:            ReservedIdentityWorld,
-		labels.IDNameWorldIPv4:        ReservedIdentityWorldIPv4,
-		labels.IDNameWorldIPv6:        ReservedIdentityWorldIPv6,
-		labels.IDNameUnmanaged:        ReservedIdentityUnmanaged,
-		labels.IDNameHealth:           ReservedIdentityHealth,
-		labels.IDNameInit:             ReservedIdentityInit,
-		labels.IDNameRemoteNode:       ReservedIdentityRemoteNode,
-		labels.IDNameKubeAPIServer:    ReservedIdentityKubeAPIServer,
-		labels.IDNameIngress:          ReservedIdentityIngress,
-		labels.IDNameEncryptedOverlay: ReservedEncryptedOverlay,
+		labels.IDNameHost:          ReservedIdentityHost,
+		labels.IDNameWorld:         ReservedIdentityWorld,
+		labels.IDNameWorldIPv4:     ReservedIdentityWorldIPv4,
+		labels.IDNameWorldIPv6:     ReservedIdentityWorldIPv6,
+		labels.IDNameUnmanaged:     ReservedIdentityUnmanaged,
+		labels.IDNameHealth:        ReservedIdentityHealth,
+		labels.IDNameInit:          ReservedIdentityInit,
+		labels.IDNameRemoteNode:    ReservedIdentityRemoteNode,
+		labels.IDNameKubeAPIServer: ReservedIdentityKubeAPIServer,
+		labels.IDNameIngress:       ReservedIdentityIngress,
 	}
 	reservedIdentityNames = map[NumericIdentity]string{
 		IdentityUnknown:               "unknown",