cni-plugin v1.5.2

Don't ignore inotifywait failures

This release fixes the issue that when the node had hit the inotify limit, deploying the linkerd-cni daemonset would silently fail. Now the problem is caught and the pod enters a crash loop until the limit is no longer surpassed.

proxy-init v2.4.1

Fail container when ip6tables fails

This release ensures that when IPv6 is enabled, the series of ip6tables commands succeed. If they fail, the proxy-init container should fail as well, instead of ignoring errors.

cni-plugin v1.5.1

Fail container when ip6tables fails

This release ensures that when IPv6 is enabled, the series of ip6tables commands succeed. If they fail, the linkerd-cni container should fail as well, instead of ignoring errors.

proxy-init v2.4.0

Allow proxy-init to create group ID rules

The new release adds support for specifying a group ID via the command line. When a group ID is specified, a new rule will be created to ignore packets generated by processes running under that group ID.

Full Changelog: proxy-init/v2.3.0...proxy-init/v2.4.0

cni-plugin v1.5.0

Fix linkerd-cni when using native sidecars (#362)

Fixes linkerd/linkerd2#11597

When the cni plugin is triggered, it validates that the proxy has been
injected into the pod before setting up the iptables rules. It does so
by looking for the "linkerd-proxy" container. However, when the proxy is
injected as a native sidecar, it gets added as an _init_ container, so
it was being disregarded here.

We don't have integration tests for validating native sidecars when
using linkerd-cni because [Calico doesn't work in k3s since k8s
1.27](https://github.com/k3d-io/k3d/issues/1375), and we require k8s
1.29 for using native sidecars.
I did nevertheless successfully test this fix in an AKS cluster.

proxy-init v2.3.0

Add IPv6/dual-stack support

This release adds the proxy-init flag `--iptables-mode` (with possible values `legacy` and `nft`), which supersedes `--firewal-bin-path` and `firewall-save-bin-path` (which still remain supported).
Also the `--ipv6` flag has been added (default `true`).

After the set of rules run via iptables are processed, if `--ipv6` is true (which is the default), the same set of rules will be run via ip6tables.

cni-plugin v1.4.0

Add IPv6/dual-stack support

This release adds the linkerd-cni flag `--iptables-mode` (with possible values `legacy` and `nft`) and the `--ipv6` flag (default `true`).

After the set of rules run via iptables are processed, if `--ipv6` is true (which is the default), the same set of rules will be run via ip6tables.

proxy-init v2.2.4

Dependencies update

Upgraded Alpine to 3.19.0, and other various dependencies bumps.

cni-plugin v1.3.0

This release adds a linkerd-cni-repair-controller binary to the cni-plugin image. This controller watches over events on pods in the current node, which have been injected but are in a terminated state and whose linkerd-network-validator container exited with code 95. This means networking couldn't be properly set, probably because of a race between the linkerd CNI plugin and the main CNI plugin in the cluster. The controller then proceeds to delete those pods so they can restart with a proper network config.

proxy-init v2.2.3

Dependency bumps and updated go to v1.21