Skip to content

Commit 508d27d

Browse files
thallgrenthallgren
authored
Merge pull request #3826 from telepresenceio/thallgren/agentpf
Only restore inactive traffic-agent after a replace.
2 parents 9ccce66 + 41729a4 commit 508d27d

File tree

16 files changed

+222
-159
lines changed

16 files changed

+222
-159
lines changed

‎CHANGELOG.yml

+9
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,15 @@
2424
#
2525
# For older changes, see CHANGELOG.OLD.md
2626
items:
27+
- version: 2.22.1
28+
date: (TBD)
29+
notes:
30+
- type: bugfix
31+
title: Only restore inactive traffic-agent after a replace.
32+
body: |-
33+
A regression in the 2.20.0 release would cause the traffic-agent to be replaced with a dormant version that
34+
didn't touch any ports when an intercept ended. This terminated other ongoing intercepts on the same pod.
35+
This is now changed so that the traffic-agent remains unaffected for this use-case.
2736
- version: 2.22.0
2837
date: 2025-03-14
2938
notes:

‎DEPENDENCIES.md

+16-16
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ following Free and Open Source software:
77
dario.cat/mergo v1.0.1 3-clause BSD license
88
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 Apache License 2.0
99
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c MIT license
10-
github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c MIT license
10+
github.com/BurntSushi/toml v1.5.0 MIT license
1111
github.com/MakeNowJust/heredoc v1.0.0 MIT license
1212
github.com/Masterminds/goutils v1.1.1 Apache License 2.0
1313
github.com/Masterminds/semver/v3 v3.3.1 MIT license
@@ -20,7 +20,7 @@ following Free and Open Source software:
2020
github.com/cenkalti/backoff/v4 v4.3.0 MIT license
2121
github.com/cespare/xxhash/v2 v2.3.0 MIT license
2222
github.com/chai2010/gettext-go v1.0.3 3-clause BSD license
23-
github.com/containerd/containerd v1.7.26 Apache License 2.0
23+
github.com/containerd/containerd v1.7.27 Apache License 2.0
2424
github.com/containerd/errdefs v1.0.0 Apache License 2.0
2525
github.com/containerd/log v0.1.0 Apache License 2.0
2626
github.com/containerd/platforms v0.2.1 Apache License 2.0
@@ -33,10 +33,10 @@ following Free and Open Source software:
3333
github.com/datawire/go-ftpserver v0.1.3 Apache License 2.0
3434
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc ISC license
3535
github.com/distribution/reference v0.6.0 Apache License 2.0
36-
github.com/docker/cli v28.0.1+incompatible Apache License 2.0
36+
github.com/docker/cli v28.0.2+incompatible Apache License 2.0
3737
github.com/docker/distribution v2.8.3+incompatible Apache License 2.0
38-
github.com/docker/docker v28.0.1+incompatible Apache License 2.0
39-
github.com/docker/docker-credential-helpers v0.9.2 MIT license
38+
github.com/docker/docker v28.0.2+incompatible Apache License 2.0
39+
github.com/docker/docker-credential-helpers v0.9.3 MIT license
4040
github.com/docker/go-connections v0.5.0 Apache License 2.0
4141
github.com/docker/go-metrics v0.0.1 Apache License 2.0
4242
github.com/docker/go-units v0.5.0 Apache License 2.0
@@ -93,7 +93,7 @@ following Free and Open Source software:
9393
github.com/mattn/go-colorable v0.1.14 MIT license
9494
github.com/mattn/go-isatty v0.0.20 MIT license
9595
github.com/mattn/go-runewidth v0.0.16 MIT license
96-
github.com/miekg/dns v1.1.63 3-clause BSD license
96+
github.com/miekg/dns v1.1.64 3-clause BSD license
9797
github.com/mitchellh/copystructure v1.2.0 MIT license
9898
github.com/mitchellh/go-wordwrap v1.0.1 MIT license
9999
github.com/mitchellh/reflectwalk v1.0.2 MIT license
@@ -114,8 +114,8 @@ following Free and Open Source software:
114114
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 3-clause BSD license
115115
github.com/prometheus/client_golang v1.21.1 3-clause BSD license, Apache License 2.0
116116
github.com/prometheus/client_model v0.6.1 Apache License 2.0
117-
github.com/prometheus/common v0.62.0 Apache License 2.0
118-
github.com/prometheus/procfs v0.15.1 Apache License 2.0
117+
github.com/prometheus/common v0.63.0 Apache License 2.0
118+
github.com/prometheus/procfs v0.16.0 Apache License 2.0
119119
github.com/puzpuzpuz/xsync/v3 v3.5.1 Apache License 2.0
120120
github.com/rivo/uniseg v0.4.7 MIT license
121121
github.com/rogpeppe/go-internal v1.14.1 3-clause BSD license
@@ -124,13 +124,13 @@ following Free and Open Source software:
124124
github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 MIT license
125125
github.com/shopspring/decimal v1.4.0 MIT license
126126
github.com/sirupsen/logrus v1.9.3 MIT license
127-
github.com/spf13/afero v1.12.0 Apache License 2.0
127+
github.com/spf13/afero v1.14.0 Apache License 2.0
128128
github.com/spf13/cast v1.7.1 MIT license
129129
github.com/spf13/cobra v1.9.1 Apache License 2.0
130130
github.com/spf13/pflag v1.0.6 3-clause BSD license
131131
github.com/stretchr/testify v1.10.0 MIT license
132-
github.com/telepresenceio/go-fuseftp v0.6.4 Apache License 2.0
133-
github.com/telepresenceio/go-fuseftp/rpc v0.6.4 Apache License 2.0
132+
github.com/telepresenceio/go-fuseftp v0.6.6 Apache License 2.0
133+
github.com/telepresenceio/go-fuseftp/rpc v0.6.6 Apache License 2.0
134134
github.com/telepresenceio/telepresence/rpc/v2 (modified) Apache License 2.0
135135
github.com/vishvananda/netlink v1.3.0 Apache License 2.0
136136
github.com/vishvananda/netns v0.0.5 Apache License 2.0
@@ -158,14 +158,14 @@ following Free and Open Source software:
158158
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 MIT license
159159
golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 MIT license
160160
golang.zx2c4.com/wireguard/windows v0.5.3 MIT license
161-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250311190419-81fb87f6b8bf Apache License 2.0
161+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 Apache License 2.0
162162
google.golang.org/grpc v1.71.0 Apache License 2.0
163163
google.golang.org/protobuf v1.36.5 3-clause BSD license
164164
gopkg.in/evanphx/json-patch.v4 v4.12.0 3-clause BSD license
165165
gopkg.in/inf.v0 v0.9.1 3-clause BSD license
166166
gopkg.in/yaml.v3 v3.0.1 Apache License 2.0, MIT license
167-
gvisor.dev/gvisor v0.0.0-20250307022919-35e47cb01460 Apache License 2.0, MIT license
168-
helm.sh/helm/v3 v3.17.1 Apache License 2.0
167+
gvisor.dev/gvisor v0.0.0-20250318191406-9e676ea1de20 Apache License 2.0, MIT license
168+
helm.sh/helm/v3 v3.17.2 Apache License 2.0
169169
k8s.io/api v0.32.3 Apache License 2.0
170170
k8s.io/apiextensions-apiserver v0.32.3 Apache License 2.0
171171
k8s.io/apimachinery v0.32.3 3-clause BSD license, Apache License 2.0
@@ -174,9 +174,9 @@ following Free and Open Source software:
174174
k8s.io/client-go v0.32.3 3-clause BSD license, Apache License 2.0
175175
k8s.io/component-base v0.32.3 Apache License 2.0
176176
k8s.io/klog/v2 v2.130.1 Apache License 2.0
177-
k8s.io/kube-openapi v0.0.0-20250304201544-e5f78fe3ede9 3-clause BSD license, Apache License 2.0
177+
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff 3-clause BSD license, Apache License 2.0
178178
k8s.io/kubectl v0.32.3 Apache License 2.0
179-
k8s.io/utils v0.0.0-20241210054802-24370beab758 3-clause BSD license, Apache License 2.0
179+
k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e 3-clause BSD license, Apache License 2.0
180180
oras.land/oras-go v1.2.6 Apache License 2.0
181181
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 3-clause BSD license, Apache License 2.0
182182
sigs.k8s.io/kustomize/api v0.19.0 Apache License 2.0

‎cmd/traffic/cmd/manager/state/intercept.go

+6-5
Original file line numberDiff line numberDiff line change
@@ -513,18 +513,19 @@ func (s *state) restoreAppContainer(ctx context.Context, ii *rpc.InterceptInfo,
513513
return nil, nil
514514
}
515515
var cn *agentconfig.Container
516+
var desiredPolicy agentconfig.ReplacePolicy
516517
if spec.NoDefaultPort {
518+
desiredPolicy = agentconfig.ReplacePolicyInactive
517519
cn, err = findContainer(sce.AgentConfig(), spec)
518520
} else {
521+
// Let's keep the intercepting agent in place. There might be other intercepts or wiretaps active.
522+
desiredPolicy = agentconfig.ReplacePolicyIntercept
519523
cn, _, err = findIntercept(sce.AgentConfig(), spec)
520524
}
521-
if err != nil {
522-
return nil, nil
523-
}
524-
if cn.Replace == agentconfig.ReplacePolicyInactive {
525+
if err != nil || cn.Replace == desiredPolicy {
525526
return nil, nil
526527
}
527-
cn.Replace = agentconfig.ReplacePolicyInactive
528+
cn.Replace = desiredPolicy
528529

529530
// The pods for this workload will be killed once the new updated sidecar
530531
// reaches the configmap. We inactivate them now, so that they don't continue to

‎docs/compare/mirrord.md

+3-5
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,11 @@ The client can be either completely contained in Docker or run directly on the w
1616
Mirrord was designed with simplicity in mind. You install the CLI tool, and that's it. It will do the rest automatically under the hood.
1717

1818
Mirrord solves the same problem as Telepresence, but in a different way. Instead of providing a proper network
19-
device and remotely mounted filesystems, mirrord will link the client application with a `mirrord-layer` shared library. This library will intercept accesses to the network, file system, and environment variables, and reroute them to a corresponding process in the cluster (the `mirrord-agent`) which then interacts with the targeted pod.
19+
device and remotely mounted filesystems, mirrord will link the client application with a `mirrord-layer` shared library. This library will inject code that intercepts accesses to the network, file system, and environment variables, and reroute them to a corresponding process in the cluster (the `mirrord-agent`) which then interacts with the targeted pod.
2020

21-
### Limitations
21+
### Limitations with Code Injection
2222

23-
While mirrotd is simple to set up, the chosen approach has several limitations, both on the client and the cluster side.
24-
25-
### Limitations when using dynamic loading:
23+
Telepresence 1.x used the [code injection approach](https://www.getambassador.io/blog/code-injection-on-linux-and-macos), but desided to abandon it due to several limitations:
2624

2725
1. It will only work on Linux and macOS platforms. There's no native support on Windows.
2826
2. It will only work with dynamically linked executables.

‎docs/release-notes.md

+9
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11

22
[comment]: # (Code generated by relnotesgen. DO NOT EDIT.)
33
# <img src="images/logo.png" height="64px"/> Telepresence Release Notes
4+
## Version 2.22.1
5+
## <div style="display:flex;"><img src="images/bugfix.png" alt="bugfix" style="width:30px;height:fit-content;"/><div style="display:flex;margin-left:7px;">Only restore inactive traffic-agent after a replace.</div></div>
6+
<div style="margin-left: 15px">
7+
8+
A regression in the 2.20.0 release would cause the traffic-agent to be replaced with a dormant version that
9+
didn't touch any ports when an intercept ended. This terminated other ongoing intercepts on the same pod.
10+
This is now changed so that the traffic-agent remains unaffected for this use-case.
11+
</div>
12+
413
## Version 2.22.0 <span style="font-size: 16px;">(March 14)</span>
514
## <div style="display:flex;"><img src="images/feature.png" alt="feature" style="width:30px;height:fit-content;"/><div style="display:flex;margin-left:7px;">New telepresence replace command.</div></div>
615
<div style="margin-left: 15px">

‎docs/release-notes.mdx

+9
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,15 @@ import { Note, Title, Body } from '@site/src/components/ReleaseNotes'
77
[comment]: # (Code generated by relnotesgen. DO NOT EDIT.)
88

99
# Telepresence Release Notes
10+
## Version 2.22.1
11+
<Note>
12+
<Title type="bugfix">Only restore inactive traffic-agent after a replace.</Title>
13+
<Body>
14+
A regression in the 2.20.0 release would cause the traffic-agent to be replaced with a dormant version that
15+
didn't touch any ports when an intercept ended. This terminated other ongoing intercepts on the same pod.
16+
This is now changed so that the traffic-agent remains unaffected for this use-case.
17+
</Body>
18+
</Note>
1019
## Version 2.22.0 <span style={{fontSize:'16px'}}>(March 14)</span>
1120
<Note>
1221
<Title type="feature">New telepresence replace command.</Title>

‎docs/variables.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
version: "2.22.0"
2-
dlVersion: "v2.22.0"
1+
version: "2.22.1"
2+
dlVersion: "v2.22.1"

0 commit comments

Comments
 (0)