| Age | Commit message (Collapse) | Author |
|---|
|
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
|
|
vpp: T8036: Commit fails removing nat44 static rule
|
|
frr: T8034: use dict_search() for routing protocols to check if VRF is used
|
|
T7319: check for unsaved commits before proceeding with 'add system image'
|
|
|
|
dict_search() is save when passing in keys that do not exist in the dict
we are working on.
|
|
kea: T7913: Fixes for ping-check handling
|
|
|
|
firewall: T7739: Default ruleset for firewall zones
|
|
bond: T8023: validate member interface min/max MTU
|
|
It is impossible to set the bond interface MTU to be larger or lower then the
limits of the underlaying interface MTU. Add proper commit validation and
smoketest.
|
|
- Kea docs state multi-threaded mode is required for ping checking.
- Parent scope needs enabling if shared-network/subnet has ping-check enabled.
|
|
Add a commit-time check and warning to the user if the TACACS source-address is
not configured on the system or the given VRF.
|
|
Add a commit-time check and warning to the user if the RADIUS source-address
(IPv4 or IPv6) is not configured on the system or the given VRF.
|
|
|
|
veth: T8017: bugfix KeyError: 'peer_name'
|
|
T8012: Add user vpp to user groups
|
|
To allow call VPP api without sudo
- Get op-mode commands without sudo
- Use API call in smoke-tests
|
|
T7556: VPP add IPFIX collector configuration
|
|
Use safe dict_search() function to locate veth peer interface name. If no peer
is defined an error will be displayed.
|
|
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
After T7836: move bind mount of /config to vyos-1x, the bind mount is
configured at boot, not within the initrd. On image install, one needs
to check for previous installations in the resident directory
/opt/vyatta/etc/config of the mounted disk.
|
|
removed from vif
Do not allow to delete subinterface if it is in use in VPP features
|
|
T7731: Static ARP entries are missing after an interface status change
|
|
|
|
|
|
|
|
firewall: T7112: Default action drop fails
|
|
The standalone script teardown-config-session.py is called on CLI
config-mode exit, to close the persistent vyconf config session. Instead
of injecting the config-mode env var into the external script to
indicate a non-ephemeral session, add keyword 'extant' to find existing
session.
|
|
Prevent `KeyError` by safely handling missing 'member' dict in zone config.
Add smoketest to verify commit fails gracefully when zone has no interfaces.
|
|
container: T7305: fix VRF loss when restarting pods
|
|
pki: T7976: calls to node_changed_presence() must use unmangled config paths
|
|
T7789: T7661: VPP prevent failing to load XDP in clouds (ena/gve drivers)
|
|
- Drop "tls enable" node (make "tls" a standalone key).
- Split "tls permitted-peers" list by commas into multiple "tls permitted-peer" entries.
|
|
Container networks are only started when there is at least one active consumer.
If a network is created without any attached containers, it does not need to be
assigned to a VRF yet.
When the last container in a pod is stopped, its associated container network
is removed. Upon container restart, the kernel recreates the network, but the
VRF assignment may be lost in the process.
This change ensures that all container networks are correctly reattached to
their designated VRFs when a pod restarts.
|
|
T7949: VPP add the ability to configure bond subinterfaces for NAT
|
|
T7980: Load active config on vyconfd restart
|
|
wlb: T7966: Restore default route when interface disconnects/reconnects
|
|
We do use mangled config paths where
pki = conf.get_config_dict(base, key_mangling=('-', '_'), ...
returns a config dict where "-" is replaced by "_" when assembling the config
dict keys.
This does not work when we throw the retrieved path into
ConfigDiff().node_changed_presence()
https://github.com/vyos/vyos-1x/blob/07936657062c/src/conf_mode/pki.py#L259-L265
Add orig_path key which is preferred over path.
|
|
|
|
To ensure consistency of vyconfd restart in the testing framework, defer
startup until execution of set_vyconf_backend.py. This will be restored
to vyos-router once vyos-boot-config-loader.py is adapted to vyconf.
|
|
pki: T7953: implement certbot_renew() function to have everything at one place
|
|
Some cloud NICs (ena, gve) fail to load XDP if all RX queues are configured. To
avoid this, we limit the number of queues to half of the maximum supported by the driver.
|
|
checks
- Renamed `permitted-peers` to `permitted-peer` across templates, schema, and tests.
- Added support for multiple `permitted-peer` entries and trimmed empty values.
- Replaced TLS/UDP warning with ConfigError for strict validation.
- Updated tests to use TCP for TLS and verified new validation logic.
|
|
|
|
T7797: VPP: switching from XDP to DPDK driver fails in cloud vm (hv_netvsc)
|
|
T6686: adds container health checks
|
|
PrivateTmp needs to be disabled, otherwise we can not load the current
VyOS configuration to reconfigure the service automatically when certbot
runs.
|
|
|
