Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
WalkthroughAdded English and Chinese solution pages documenting how to deploy Cilium (ACP 4.2+ in Custom network mode) and configure an eBPF L4 LoadBalancer with source IP preservation, including prerequisites, temporary RBAC, kube-proxy removal/cleanup, VIP allocation, L2 ARP failover resources, and verification steps. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
docs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md (2)
80-91: Reduce RBAC permissions from wildcard to specific verbs.The temporary RBAC configuration grants wildcard permissions (
verbs: ["*"]) which is overly permissive, even temporarily. Consider restricting to only the necessary verbs.🔒 Proposed fix to use specific permissions
rules: - apiGroups: ["cluster.alauda.io"] resources: ["clusterplugininstances"] - verbs: ["*"] + verbs: ["get", "list", "create", "update", "patch"]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md` around lines 80 - 91, The ClusterRole cilium-clusterplugininstance-admin grants wildcard verbs ["*"] for apiGroups "cluster.alauda.io" and resources "clusterplugininstances"; replace the wildcard with an explicit minimal verbs list required by the component (e.g., get, list, watch, create, update, patch, delete) or an even smaller subset if some actions are unnecessary—edit the ClusterRole resource in the tmp.yaml to remove verbs: ["*"] and add the specific verbs needed.
10-10: Consider clarifying "S2 方案" terminology.The title references "S2 方案" (S2 solution) which may not be immediately clear to all readers. Consider adding a brief explanation of what "S2" refers to in this context, or removing it if it's internal terminology.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md` at line 10, 标题中出现的“S2 方案”术语可能不够清晰；在文档顶部标题行（"# 基于 eBPF 的高性能容器网络 Cilium CNI 和 eBPF 实现的高性能四层负载均衡（支持源 IP 可见的 S2 方案）"）处，添加一段简短说明以解释“S2”代表的具体含义或替换为更通用的描述，例如在标题后紧接一行括号内或在引言段落中用一句话说明“S2”为何种架构/方案，确保读者能立刻理解该术语；如果“S2”为内部简称且无必要，则直接移除以避免歧义。docs/en/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md (1)
81-91: Reduce RBAC permissions from wildcard to specific verbs.The temporary RBAC grants wildcard permissions (
verbs: ["*"]), which is overly permissive even temporarily. Consider using only the required verbs.🔒 Proposed fix for more restrictive permissions
rules: - apiGroups: ["cluster.alauda.io"] resources: ["clusterplugininstances"] - verbs: ["*"] + verbs: ["get", "list", "create", "update", "patch"]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/en/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md` around lines 81 - 91, The ClusterRole cilium-clusterplugininstance-admin currently uses verbs: ["*"] for apiGroup "cluster.alauda.io" and resource "clusterplugininstances"; replace the wildcard with explicit, minimal verbs required by the controller (e.g. ["get","list","watch","create","update","patch"] as a starting point and omit "delete" unless the component actually needs it), update the manifest block that creates the ClusterRole to use those specific verbs, and verify functionality and apply the least-privilege set after testing.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@docs/en/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md`:
- Line 174: The kube-proxy image reference "image:
registry.alauda.cn:60070/tkestack/kube-proxy:v1.33.5" is outdated; update that
image tag to a current kube-proxy release (e.g., v1.35.x or v1.34.x) consistent
with the version chosen in Step 1, and verify the container image registry/name
remains "registry.alauda.cn:60070/tkestack/kube-proxy" while only changing the
tag to the selected newer version.
In
`@docs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md`:
- Line 173: Replace the hardcoded example image tag
"registry.alauda.cn:60070/tkestack/kube-proxy:v1.33.5" with a current version or
an explicit placeholder; e.g., update to
"registry.alauda.cn:60070/tkestack/kube-proxy:v1.35.x" or use a template
placeholder like "{{KUBE_PROXY_IMAGE}}" and keep the existing comment about
replacing it for the target environment so readers aren’t confused by an
outdated example.
---
Nitpick comments:
In
`@docs/en/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md`:
- Around line 81-91: The ClusterRole cilium-clusterplugininstance-admin
currently uses verbs: ["*"] for apiGroup "cluster.alauda.io" and resource
"clusterplugininstances"; replace the wildcard with explicit, minimal verbs
required by the controller (e.g.
["get","list","watch","create","update","patch"] as a starting point and omit
"delete" unless the component actually needs it), update the manifest block that
creates the ClusterRole to use those specific verbs, and verify functionality
and apply the least-privilege set after testing.
In
`@docs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md`:
- Around line 80-91: The ClusterRole cilium-clusterplugininstance-admin grants
wildcard verbs ["*"] for apiGroups "cluster.alauda.io" and resources
"clusterplugininstances"; replace the wildcard with an explicit minimal verbs
list required by the component (e.g., get, list, watch, create, update, patch,
delete) or an even smaller subset if some actions are unnecessary—edit the
ClusterRole resource in the tmp.yaml to remove verbs: ["*"] and add the specific
verbs needed.
- Line 10: 标题中出现的“S2 方案”术语可能不够清晰；在文档顶部标题行（"# 基于 eBPF 的高性能容器网络 Cilium CNI 和 eBPF
实现的高性能四层负载均衡（支持源 IP 可见的 S2
方案）"）处，添加一段简短说明以解释“S2”代表的具体含义或替换为更通用的描述，例如在标题后紧接一行括号内或在引言段落中用一句话说明“S2”为何种架构/方案，确保读者能立刻理解该术语；如果“S2”为内部简称且无必要，则直接移除以避免歧义。
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 940dc40f-96fe-49f5-b6ba-b9a2013c2aa4
📒 Files selected for processing (2)
docs/en/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.mddocs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md
| - operator: Exists | ||
| containers: | ||
| - name: kube-proxy-cleanup | ||
| image: registry.alauda.cn:60070/tkestack/kube-proxy:v1.33.5 ## Replace with the kube-proxy image from Step 1 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the latest stable Kubernetes version as of March 2025?
💡 Result:
The latest stable Kubernetes version as of March 2025 was v1.32.x (with v1.32.13 released February 26, 2026, still supported until end of February 2026 per policy). However, by late March 2025, v1.33 would have been released (April 23, 2025 per blog), becoming the latest stable. v1.34 and v1.35 followed later in 2025. The official Kubernetes releases page lists v1.35.3 (March 19, 2026) as the current latest stable release today.
Citations:
- 1: https://kubernetes.io/releases/
- 2: https://www.k8s.io/releases/
- 3: https://github.com/kubernetes/kubernetes/tags
- 4: https://kubernetes.io/blog/2025/11/26/kubernetes-v1-35-sneak-peek/
- 5: https://kubernetes.io/blog/2025/04/23/kubernetes-v1-33-release
- 6: https://github.com/kubernetes/kubernetes/releases
Replace the outdated kube-proxy version with a current one.
The kube-proxy version v1.33.5 is outdated for the current time period. While v1.33 is a valid Kubernetes release (released April 2025), it's no longer current in March 2026. Use a more recent version like v1.35 or v1.34 to avoid potential compatibility or security issues.
Suggested fix
- image: registry.alauda.cn:60070/tkestack/kube-proxy:v1.33.5 ## Replace with the kube-proxy image from Step 1
+ image: registry.alauda.cn:60070/tkestack/kube-proxy:v1.35.3 ## Replace with the kube-proxy image from Step 1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| image: registry.alauda.cn:60070/tkestack/kube-proxy:v1.33.5 ## Replace with the kube-proxy image from Step 1 | |
| image: registry.alauda.cn:60070/tkestack/kube-proxy:v1.35.3 ## Replace with the kube-proxy image from Step 1 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@docs/en/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md`
at line 174, The kube-proxy image reference "image:
registry.alauda.cn:60070/tkestack/kube-proxy:v1.33.5" is outdated; update that
image tag to a current kube-proxy release (e.g., v1.35.x or v1.34.x) consistent
with the version chosen in Step 1, and verify the container image registry/name
remains "registry.alauda.cn:60070/tkestack/kube-proxy" while only changing the
tag to the selected newer version.
docs/zh/solutions/How_to_Deploy_Cilium_eBPF_L4_LoadBalancer_with_Source_IP_Preservation.md
Outdated
Show resolved
Hide resolved
介绍如何在 ACP 4.2+ 集群中部署 Cilium CNI， 利用 eBPF 实现高性能四层负载均衡，支持源 IP 透传。
changluyi
force-pushed
the
feature/cilium-ebpf-doc-clean
branch
from
5e1790c to
e655c22
Compare
- 将 kube-proxy 镜像版本改为占位符 <KUBERNETES_VERSION> - 移除麒麟操作系统支持（Kylin V10-SP3）
1 participant
Summary
内容概要
Test plan
Summary by CodeRabbit