Repository: cilium/cilium
Pull request #12689 (2020-07-27 20:45:27)

smoke-test: Print pod/deploy state on failure
Improve the smoke test debuggability by printing pod and deployment state when it fails.

coveralls: 
[![Coverage Status](https://coveralls.io/builds/32355144/badge)](https://coveralls.io/builds/32355144)

Coverage decreased (-0.04%) to 37.165% when pulling **b4e417cce395167638e342db1f78a82a491c0714 on joestringer:submit/improve-smoke-test-output** into **87fe5c0d44044324e7b6793d4126e45ba6d4d167 on cilium:master**.


Patch:
diff --git a/Documentation/cheatsheet.rst b/Documentation/cheatsheet.rst
index 6e62f6f691..cda9db64a4 100644
--- a/Documentation/cheatsheet.rst
+++ b/Documentation/cheatsheet.rst
@@ -314,12 +314,6 @@ Flush connection tracking entries:
 
     sudo cilium bpf ct flush
 
-List proxy configuration:
-::
-
-    sudo cilium bpf proxy list
-
-
 Kubernetes examples:
 =====================
 
diff --git a/Documentation/cmdref/cilium_bpf.md b/Documentation/cmdref/cilium_bpf.md
index b2572a4b5c..38e4c247e1 100644
--- a/Documentation/cmdref/cilium_bpf.md
+++ b/Documentation/cmdref/cilium_bpf.md
@@ -34,7 +34,6 @@ Direct access to local BPF maps
 * [cilium bpf metrics](../cilium_bpf_metrics)	 - BPF datapath traffic metrics
 * [cilium bpf nat](../cilium_bpf_nat)	 - NAT mapping tables
 * [cilium bpf policy](../cilium_bpf_policy)	 - Manage policy related BPF maps
-* [cilium bpf proxy](../cilium_bpf_proxy)	 - Proxy configuration
 * [cilium bpf sha](../cilium_bpf_sha)	 - Manage compiled BPF template objects
 * [cilium bpf tunnel](../cilium_bpf_tunnel)	 - Tunnel endpoint map
 
diff --git a/Documentation/cmdref/cilium_bpf_proxy.md b/Documentation/cmdref/cilium_bpf_proxy.md
deleted file mode 100644
index ae0ee7044e..0000000000
--- a/Documentation/cmdref/cilium_bpf_proxy.md
+++ /dev/null
@@ -1,30 +0,0 @@
-<!-- This file was autogenerated via cilium cmdref, do not edit manually-->
-
-## cilium bpf proxy
-
-Proxy configuration
-
-### Synopsis
-
-Proxy configuration
-
-### Options
-
-```
-  -h, --help   help for proxy
-```
-
-### Options inherited from parent commands
-
-```
-      --config string   config file (default is $HOME/.cilium.yaml)
-  -D, --debug           Enable debug messages
-  -H, --host string     URI to server-side API
-```
-
-### SEE ALSO
-
-* [cilium bpf](../cilium_bpf)	 - Direct access to local BPF maps
-* [cilium bpf proxy flush](../cilium_bpf_proxy_flush)	 - Flush all proxy entries (deprecated)
-* [cilium bpf proxy list](../cilium_bpf_proxy_list)	 - List proxy configuration (deprecated)
-
diff --git a/Documentation/cmdref/cilium_bpf_proxy_flush.md b/Documentation/cmdref/cilium_bpf_proxy_flush.md
deleted file mode 100644
index 747fb1fd54..0000000000
--- a/Documentation/cmdref/cilium_bpf_proxy_flush.md
+++ /dev/null
@@ -1,32 +0,0 @@
-<!-- This file was autogenerated via cilium cmdref, do not edit manually-->
-
-## cilium bpf proxy flush
-
-Flush all proxy entries (deprecated)
-
-### Synopsis
-
-Flush all proxy entries (deprecated)
-
-```
-cilium bpf proxy flush [flags]
-```
-
-### Options
-
-```
-  -h, --help   help for flush
-```
-
-### Options inherited from parent commands
-
-```
-      --config string   config file (default is $HOME/.cilium.yaml)
-  -D, --debug           Enable debug messages
-  -H, --host string     URI to server-side API
-```
-
-### SEE ALSO
-
-* [cilium bpf proxy](../cilium_bpf_proxy)	 - Proxy configuration
-
diff --git a/Documentation/cmdref/cilium_bpf_proxy_list.md b/Documentation/cmdref/cilium_bpf_proxy_list.md
deleted file mode 100644
index 58212b2e0d..0000000000
--- a/Documentation/cmdref/cilium_bpf_proxy_list.md
+++ /dev/null
@@ -1,33 +0,0 @@
-<!-- This file was autogenerated via cilium cmdref, do not edit manually-->
-
-## cilium bpf proxy list
-
-List proxy configuration (deprecated)
-
-### Synopsis
-
-List proxy configuration (deprecated)
-
-```
-cilium bpf proxy list [flags]
-```
-
-### Options
-
-```
-  -h, --help            help for list
-  -o, --output string   json| jsonpath='{}'
-```
-
-### Options inherited from parent commands
-
-```
-      --config string   config file (default is $HOME/.cilium.yaml)
-  -D, --debug           Enable debug messages
-  -H, --host string     URI to server-side API
-```
-
-### SEE ALSO
-
-* [cilium bpf proxy](../cilium_bpf_proxy)	 - Proxy configuration
-
diff --git a/Documentation/gettingstarted/k8s-install-azure-cni-steps.rst b/Documentation/gettingstarted/k8s-install-azure-cni-steps.rst
index 8d941989ba..ba3ff04164 100644
--- a/Documentation/gettingstarted/k8s-install-azure-cni-steps.rst
+++ b/Documentation/gettingstarted/k8s-install-azure-cni-steps.rst
@@ -66,7 +66,7 @@ Deploy Cilium release via Helm:
      --set global.cni.chainingMode=generic-veth \\
      --set global.cni.customConf=true \\
      --set global.nodeinit.enabled=true \\
-     --set nodeinit.azure=true \\
+     --set global.azure.enabled=true \\
      --set global.cni.configMap=cni-configuration \\
      --set global.tunnel=disabled \\
      --set global.masquerade=false
diff --git a/bugtool/cmd/configuration.go b/bugtool/cmd/configuration.go
index 04d74fa505..8939cdf0b1 100644
--- a/bugtool/cmd/configuration.go
+++ b/bugtool/cmd/configuration.go
@@ -237,7 +237,6 @@ func copyCiliumInfoCommands(cmdDir string, k8sPods []string) []string {
 		"cilium bpf ct list global",
 		"cilium bpf nat list",
 		"cilium bpf ipmasq list",
-		"cilium bpf proxy list",
 		"cilium bpf ipcache list",
 		"cilium bpf policy get --all --numeric",
 		"cilium bpf sha list",
diff --git a/cilium/cmd/bpf_proxy.go b/cilium/cmd/bpf_proxy.go
deleted file mode 100644
index 9c4ba69752..0000000000
--- a/cilium/cmd/bpf_proxy.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2018 Authors of Cilium
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-)
-
-// bpfProxyCmd represents the bpf_proxy command
-var bpfProxyCmd = &cobra.Command{
-	Use:   "proxy",
-	Short: "Proxy configuration",
-}
-
-func init() {
-	bpfCmd.AddCommand(bpfProxyCmd)
-}
diff --git a/cilium/cmd/bpf_proxy_flush.go b/cilium/cmd/bpf_proxy_flush.go
deleted file mode 100644
index 2c09aa8931..0000000000
--- a/cilium/cmd/bpf_proxy_flush.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2018 Authors of Cilium
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/cilium/cilium/pkg/common"
-
-	"github.com/spf13/cobra"
-)
-
-// bpfProxyFlushCmd represents the bpf_proxy_flush command
-var bpfProxyFlushCmd = &cobra.Command{
-	Use:    "flush",
-	Short:  "Flush all proxy entries (deprecated)",
-	PreRun: requireEndpointIDorGlobal,
-	Run: func(cmd *cobra.Command, args []string) {
-		common.RequireRootPrivilege("cilium bpf proxy flush")
-		entries := 0
-		fmt.Printf("Flushed %d entries\n", entries)
-	},
-}
-
-func init() {
-	bpfProxyCmd.AddCommand(bpfProxyFlushCmd)
-}
diff --git a/cilium/cmd/bpf_proxy_list.go b/cilium/cmd/bpf_proxy_list.go
deleted file mode 100644
index fc0243215c..0000000000
--- a/cilium/cmd/bpf_proxy_list.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// Copyright 2018 Authors of Cilium
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package cmd
-
-import (
-	"os"
-
-	"github.com/cilium/cilium/pkg/command"
-	"github.com/cilium/cilium/pkg/common"
-	"github.com/spf13/cobra"
-)
-
-const (
-	proxyTitle       = "KEY"
-	destinationTitle = "VALUE"
-)
-
-// bpfProxyListCmd represents the bpf_proxy_list command
-var bpfProxyListCmd = &cobra.Command{
-	Use:     "list",
-	Aliases: []string{"ls"},
-	Short:   "List proxy configuration (deprecated)",
-	Run: func(cmd *cobra.Command, args []string) {
-		common.RequireRootPrivilege("cilium bpf proxy list")
-
-		proxyList := make(map[string][]string)
-
-		if command.OutputJSON() {
-			if err := command.PrintOutput(proxyList); err != nil {
-				os.Exit(1)
-			}
-			return
-		}
-
-		TablePrinter(proxyTitle, destinationTitle, proxyList)
-	},
-}
-
-func init() {
-	bpfProxyCmd.AddCommand(bpfProxyListCmd)
-	command.AddJSONOutput(bpfProxyListCmd)
-}
diff --git a/cilium/cmd/bpf_tunnel_list.go b/cilium/cmd/bpf_tunnel_list.go
index 29f052f2cb..b3eb87097c 100644
--- a/cilium/cmd/bpf_tunnel_list.go
+++ b/cilium/cmd/bpf_tunnel_list.go
@@ -25,7 +25,8 @@ import (
 )
 
 const (
-	tunnelTitle = "TUNNEL"
+	tunnelTitle      = "TUNNEL"
+	destinationTitle = "VALUE"
 )
 
 var bpfTunnelListCmd = &cobra.Command{
diff --git a/daemon/cmd/datapath.go b/daemon/cmd/datapath.go
index c30043a6f4..9a9e15755c 100644
--- a/daemon/cmd/datapath.go
+++ b/daemon/cmd/datapath.go
@@ -310,9 +310,8 @@ func (d *Daemon) initMaps() error {
 	}
 
 	// Delete old maps if left over from an upgrade.
-	// TODO: Remove proxymaps when Cilium 1.6 is the oldest supported release.
 	// TODO: Remove policy map when Cilium 1.8 is the oldest supported release.
-	for _, name := range []string{"cilium_proxy4", "cilium_proxy6", "cilium_policy"} {
+	for _, name := range []string{"cilium_policy"} {
 		path := bpf.MapPath(name)
 		if _, err := os.Stat(path); err == nil {
 			if err = os.RemoveAll(path); err == nil {
diff --git a/install/kubernetes/cilium/charts/hubble-ui/templates/deployment.yaml b/install/kubernetes/cilium/charts/hubble-ui/templates/deployment.yaml
index b91204c4a1..1cbca10e1b 100644
--- a/install/kubernetes/cilium/charts/hubble-ui/templates/deployment.yaml
+++ b/install/kubernetes/cilium/charts/hubble-ui/templates/deployment.yaml
@@ -17,6 +17,7 @@ spec:
       securityContext:
         runAsUser: 1001
       {{- end }}
+      serviceAccount: hubble-ui
       serviceAccountName: hubble-ui
       containers:
         - name: hubble-ui
diff --git a/install/kubernetes/cilium/charts/nodeinit/templates/daemonset.yaml b/install/kubernetes/cilium/charts/nodeinit/templates/daemonset.yaml
index b82dab318b..a1f9e06b35 100644
--- a/install/kubernetes/cilium/charts/nodeinit/templates/daemonset.yaml
+++ b/install/kubernetes/cilium/charts/nodeinit/templates/daemonset.yaml
@@ -148,7 +148,7 @@ spec:
               ip -4 a
               ip -6 a
 
-{{- if .Values.azure }}
+{{- if .Values.global.azure.enabled }}
               # Azure specific: Transparent bridge mode is required in order
               # for proxy-redirection to work
               until [ -f /var/run/azure-vnet.json ]; do
diff --git a/install/kubernetes/cilium/charts/nodeinit/values.yaml b/install/kubernetes/cilium/charts/nodeinit/values.yaml
index f9d9486544..fe29f64404 100644
--- a/install/kubernetes/cilium/charts/nodeinit/values.yaml
+++ b/install/kubernetes/cilium/charts/nodeinit/values.yaml
@@ -11,9 +11,5 @@ reconfigureKubelet: false
 # Delete the cbr0 bridge if it exists (GKE)
 removeCbrBridge: false
 
-# Wait for the /var/run/azure-vnet.json file to be created before continuing the
-# script
-azure: false
-
 # Revert nodeinit changes via preStop container lifecycle hook
 revertReconfigureKubelet: false
diff --git a/install/kubernetes/experimental-install.yaml b/install/kubernetes/experimental-install.yaml
index 51da78ec84..3d244beb86 100644
--- a/install/kubernetes/experimental-install.yaml
+++ b/install/kubernetes/experimental-install.yaml
@@ -750,6 +750,7 @@ spec:
     spec:
       securityContext:
         runAsUser: 1001
+      serviceAccount: hubble-ui
       serviceAccountName: hubble-ui
       containers:
         - name: hubble-ui
diff --git a/pkg/endpoint/endpoint.go b/pkg/endpoint/endpoint.go
index 12b9f1efd0..316884e186 100644
--- a/pkg/endpoint/endpoint.go
+++ b/pkg/endpoint/endpoint.go
@@ -377,18 +377,6 @@ func (e *Endpoint) HasIpvlanDataPath() bool {
 	return false
 }
 
-// GetIngressPolicyEnabledLocked returns whether ingress policy enforcement is
-// enabled for endpoint or not. The endpoint's mutex must be held.
-func (e *Endpoint) GetIngressPolicyEnabledLocked() bool {
-	return e.desiredPolicy.IngressPolicyEnabled
-}
-
-// GetEgressPolicyEnabledLocked returns whether egress policy enforcement is
-// enabled for endpoint or not. The endpoint's mutex must be held.
-func (e *Endpoint) GetEgressPolicyEnabledLocked() bool {
-	return e.desiredPolicy.EgressPolicyEnabled
-}
-
 // waitForProxyCompletions blocks until all proxy changes have been completed.
 // Called with buildMutex held.
 func (e *Endpoint) waitForProxyCompletions(proxyWaitGroup *completion.WaitGroup) error {
diff --git a/pkg/endpoint/regeneration/owner.go b/pkg/endpoint/regeneration/owner.go
index 86d9673176..561461aad4 100644
--- a/pkg/endpoint/regeneration/owner.go
+++ b/pkg/endpoint/regeneration/owner.go
@@ -1,4 +1,4 @@
-// Copyright 2016-2019 Authors of Cilium
+// Copyright 2016-2020 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -60,8 +60,6 @@ type EndpointInfoSource interface {
 	HasSidecarProxy() bool
 	ConntrackName() string
 	ConntrackNameLocked() string
-	GetIngressPolicyEnabledLocked() bool
-	GetEgressPolicyEnabledLocked() bool
 	ProxyID(npMap policy.NamedPortsMap, l4 *policy.L4Filter) (string, error)
 	GetProxyInfoByFields() (uint64, string, string, []string, string, uint64, error)
 }
diff --git a/pkg/health/client/client.go b/pkg/health/client/client.go
index 790eee2652..132a3bfc38 100644
--- a/pkg/health/client/client.go
+++ b/pkg/health/client/client.go
@@ -33,10 +33,27 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
+type ConnectivityStatusType int
+
 const (
 	ipUnavailable = "Unavailable"
+
+	ConnStatusReachable   ConnectivityStatusType = 0
+	ConnStatusUnreachable ConnectivityStatusType = 1
+	ConnStatusUnknown     ConnectivityStatusType = 2
 )
 
+func (c ConnectivityStatusType) String() string {
+	switch c {
+	case ConnStatusReachable:
+		return "reachable"
+	case ConnStatusUnreachable:
+		return "unreachable"
+	default:
+		return "unknown"
+	}
+}
+
 // Client is a client for cilium health
 type Client struct {
 	clientapi.CiliumHealthAPI
@@ -111,13 +128,51 @@ func Hint(err error) error {
 	return fmt.Errorf("%s", e)
 }
 
-func connectivityStatusHealthy(cs *models.ConnectivityStatus) bool {
-	return cs != nil && cs.Status == ""
+func GetConnectivityStatusType(cs *models.ConnectivityStatus) ConnectivityStatusType {
+	// If the connecticity status is nil, it means that there was no
+	// successful probe, but also no failed probe with a concrete reason. In
+	// that case, the status is unknown and it usually means that the new
+	// is still in the beginning of the bootstraping process.
+	if cs == nil {
+		return ConnStatusUnknown
+	}
+	// Empty status means successful probe.
+	if cs.Status == "" {
+		return ConnStatusReachable
+	}
+	// Non-empty status means that there was an explicit reason of failure.
+	return ConnStatusUnreachable
+}
+
+func GetPathConnectivityStatusType(cp *models.PathStatus) ConnectivityStatusType {
+	if cp == nil {
+		return ConnStatusUnreachable
+	}
+	statuses := []*models.ConnectivityStatus{
+		cp.Icmp,
+		cp.HTTP,
+	}
+	// Initially assume healthy status.
+	status := ConnStatusReachable
+	for _, cs := range statuses {
+		switch GetConnectivityStatusType(cs) {
+		case ConnStatusUnreachable:
+			// If any status is unreachable, return it immediately.
+			return ConnStatusUnreachable
+		case ConnStatusUnknown:
+			// If the status is unknown, prepare to return it. It's
+			// going to be returned if there is no unreachable
+			// status in next iterations.
+			status = ConnStatusUnknown
+		}
+	}
+	return status
 }
 
 func formatConnectivityStatus(w io.Writer, cs *models.ConnectivityStatus, path, indent string) {
 	status := cs.Status
-	if connectivityStatusHealthy(cs) {
+	switch GetConnectivityStatusType(cs) {
+	case ConnStatusReachable:
 		latency := time.Duration(cs.Latency)
 		status = fmt.Sprintf("OK, RTT=%s", latency)
 	}
@@ -142,9 +197,10 @@ func formatPathStatus(w io.Writer, name string, cp *models.PathStatus, indent st
 	}
 }
 
-// PathIsHealthy checks whether ICMP and TCP(HTTP) connectivity to the given
-// path is available.
-func PathIsHealthy(cp *models.PathStatus) bool {
+// pathIsHealthyOrUnknown checks whether ICMP and TCP(HTTP) connectivity to the
+// given path is available or had no explicit error status (which usually is the
+// case when the new node is provisioned).
+func pathIsHealthyOrUnknown(cp *models.PathStatus) bool {
 	if cp == nil {
 		return false
 	}
@@ -154,7 +210,8 @@ func PathIsHealthy(cp *models.PathStatus) bool {
 		cp.HTTP,
 	}
 	for _, status := range statuses {
-		if !connectivityStatusHealthy(status) {
+		switch GetConnectivityStatusType(status) {
+		case ConnStatusUnreachable:
 			return false
 		}
 	}
@@ -162,8 +219,8 @@ func PathIsHealthy(cp *models.PathStatus) bool {
 }
 
 func nodeIsHealthy(node *models.NodeStatus) bool {
-	return PathIsHealthy(GetHostPrimaryAddress(node)) &&
-		(node.Endpoint == nil || PathIsHealthy(node.Endpoint))
+	return pathIsHealthyOrUnknown(GetHostPrimaryAddress(node)) &&
+		(node.Endpoint == nil || pathIsHealthyOrUnknown(node.Endpoint))
 }
 
 func nodeIsLocalhost(node *models.NodeStatus, self *models.SelfStatus) bool {
@@ -196,10 +253,10 @@ func formatNodeStatus(w io.Writer, node *models.NodeStatus, printAll, succinct,
 	if succinct {
 		if printAll || !nodeIsHealthy(node) {
 
-			fmt.Fprintf(w, "  %s%s\t%s\t%t\t%t\n", node.Name,
+			fmt.Fprintf(w, "  %s%s\t%s\t%s\t%s\n", node.Name,
 				localStr, getPrimaryAddressIP(node),
-				PathIsHealthy(GetHostPrimaryAddress(node)),
-				PathIsHealthy(node.Endpoint))
+				GetPathConnectivityStatusType(GetHostPrimaryAddress(node)).String(),
+				GetPathConnectivityStatusType(node.Endpoint).String())
 		}
 	} else {
 		fmt.Fprintf(w, "  %s%s:\n", node.Name, localStr)
@@ -237,7 +294,7 @@ func FormatHealthStatusResponse(w io.Writer, sr *models.HealthStatusResponse, pr
 		fmt.Fprintf(w, "Cluster health:\t%d/%d reachable\t(%s)\n",
 			healthy, len(sr.Nodes), sr.Timestamp)
 		if printAll || healthy < len(sr.Nodes) {
-			fmt.Fprintf(w, "  Name\tIP\tReachable\tEndpoints reachable\n")
+			fmt.Fprintf(w, "  Name\tIP\tNode\tEndpoints\n")
 		}
 	} else {
 		fmt.Fprintf(w, "Probe time:\t%s\n", sr.Timestamp)
diff --git a/pkg/metrics/status.go b/pkg/metrics/status.go
index c7a9844d00..ce531df714 100644
--- a/pkg/metrics/status.go
+++ b/pkg/metrics/status.go
@@ -139,11 +139,15 @@ func (s *statusCollector) Collect(ch chan<- prometheus.Metric) {
 	)
 
 	for _, nodeStatus := range healthStatusResponse.Payload.Nodes {
-		if !healthClientPkg.PathIsHealthy(healthClientPkg.GetHostPrimaryAddress(nodeStatus)) {
+		switch healthClientPkg.GetPathConnectivityStatusType(healthClientPkg.GetHostPrimaryAddress(nodeStatus)) {
+		case healthClientPkg.ConnStatusUnreachable:
 			unreachableNodes++
 		}
-		if nodeStatus.Endpoint != nil && !healthClientPkg.PathIsHealthy(nodeStatus.Endpoint) {
-			unreachableEndpoints++
+		if nodeStatus.Endpoint != nil {
+			switch healthClientPkg.GetPathConnectivityStatusType(nodeStatus.Endpoint) {
+			case healthClientPkg.ConnStatusUnreachable:
+				unreachableEndpoints++
+			}
 		}
 	}
 
diff --git a/pkg/policy/distillery.go b/pkg/policy/distillery.go
index 8ff1caddb7..558337c8e7 100644
--- a/pkg/policy/distillery.go
+++ b/pkg/policy/distillery.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Authors of Cilium
+// Copyright 2019-2020 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -62,9 +62,8 @@ func (cache *PolicyCache) GetSelectorCache() *SelectorCache {
 }
 
 // lookupOrCreate adds the specified Identity to the policy cache, with a reference
-// from the specified Endpoint, then returns the threadsafe copy of the policy
-// and whether policy has been computed for this identity.
-func (cache *PolicyCache) lookupOrCreate(identity *identityPkg.Identity, create bool) (SelectorPolicy, bool) {
+// from the specified Endpoint, then returns the threadsafe copy of the policy.
+func (cache *PolicyCache) lookupOrCreate(identity *identityPkg.Identity, create bool) SelectorPolicy {
 	cache.Lock()
 	defer cache.Unlock()
 	cip, ok := cache.policies[identity.ID]
@@ -72,16 +71,12 @@ func (cache *PolicyCache) lookupOrCreate(identity *identityPkg.Identity, create
 		cip = newCachedSelectorPolicy(identity, cache.repo.GetSelectorCache())
 		cache.policies[identity.ID] = cip
 	}
-	if cip != nil {
-		return cip, cip.getPolicy().Revision > 0
-	}
-	return nil, false
+	return cip
 }
 
 // insert adds the specified Identity to the policy cache, with a reference
-// from the specified Endpoint, then returns the threadsafe copy of the policy
-// and whether policy has been computed for this identity.
-func (cache *PolicyCache) insert(identity *identityPkg.Identity) (SelectorPolicy, bool) {
+// from the specified Endpoint, then returns the threadsafe copy of the policy.
+func (cache *PolicyCache) insert(identity *identityPkg.Identity) SelectorPolicy {
 	return cache.lookupOrCreate(identity, true)
 }
 
@@ -157,8 +152,7 @@ func (cache *PolicyCache) LocalEndpointIdentityRemoved(identity *identityPkg.Ide
 // Lookup attempts to locate the SelectorPolicy corresponding to the specified
 // identity. If policy is not cached for the identity, it returns nil.
 func (cache *PolicyCache) Lookup(identity *identityPkg.Identity) SelectorPolicy {
-	cip, _ := cache.lookupOrCreate(identity, false)
-	return cip
+	return cache.lookupOrCreate(identity, false)
 }
 
 // UpdatePolicy resolves the policy for the security identity of the specified
diff --git a/pkg/proxy/logger/epinfo.go b/pkg/proxy/logger/epinfo.go
index 1e6d49731e..a41d43aea5 100644
--- a/pkg/proxy/logger/epinfo.go
+++ b/pkg/proxy/logger/epinfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Authors of Cilium
+// Copyright 2018-2020 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -39,8 +39,6 @@ type EndpointInfoSource interface {
 	// implementation.
 	ConntrackName() string
 	ConntrackNameLocked() string
-	GetIngressPolicyEnabledLocked() bool
-	GetEgressPolicyEnabledLocked() bool
 	ProxyID(npMap policy.NamedPortsMap, l4 *policy.L4Filter) (string, error)
 	GetProxyInfoByFields() (uint64, string, string, []string, string, uint64, error)
 }


Test patch:
diff --git a/.github/workflows/smoke-test.yaml b/.github/workflows/smoke-test.yaml
index 8d4c2634b5..fa5f45a039 100644
--- a/.github/workflows/smoke-test.yaml
+++ b/.github/workflows/smoke-test.yaml
@@ -83,6 +83,8 @@ jobs:
         env:
           LOG_TIME: 30m
         run: |
+          kubectl get pods -o wide
+          kubectl get deploy -o wide
           kubectl describe service echo-a
           kubectl logs service/echo-a --all-containers --since=$LOG_TIME
           kubectl describe service echo-b
diff --git a/pkg/health/client/client_test.go b/pkg/health/client/client_test.go
index adb5024508..3ae62c6301 100644
--- a/pkg/health/client/client_test.go
+++ b/pkg/health/client/client_test.go
@@ -34,6 +34,130 @@ type ClientTestSuite struct{}
 
 var _ = Suite(&ClientTestSuite{})
 
+func (s *ClientTestSuite) TestConnectivityStatusType(c *C) {
+	tests := []struct {
+		cst         ConnectivityStatusType
+		expectedStr string
+	}{
+		{
+			cst:         ConnStatusReachable,
+			expectedStr: "reachable",
+		},
+		{
+			cst:         ConnStatusUnreachable,
+			expectedStr: "unreachable",
+		},
+		{
+			cst:         ConnStatusUnknown,
+			expectedStr: "unknown",
+		},
+		{
+			cst:         10,
+			expectedStr: "unknown",
+		},
+	}
+	for _, tc := range tests {
+		c.Assert(tc.cst.String(), Equals, tc.expectedStr)
+	}
+}
+
+func (s *ClientTestSuite) TestGetConnectivityStatusType(c *C) {
+	tests := []struct {
+		cs                 *models.ConnectivityStatus
+		expectedStatusType ConnectivityStatusType
+	}{
+		{
+			cs:                 &models.ConnectivityStatus{Status: ""},
+			expectedStatusType: ConnStatusReachable,
+		},
+		{
+			cs:                 &models.ConnectivityStatus{Status: "failed"},
+			expectedStatusType: ConnStatusUnreachable,
+		},
+		{
+			cs:                 nil,
+			expectedStatusType: ConnStatusUnknown,
+		},
+	}
+	for _, tc := range tests {
+		c.Assert(GetConnectivityStatusType(tc.cs), Equals, tc.expectedStatusType)
+	}
+}
+
+func (s *ClientTestSuite) TestGetPathConnectivityStatusType(c *C) {
+	tests := []struct {
+		cp                 *models.PathStatus
+		expectedStatusType ConnectivityStatusType
+	}{
+		{
+			cp: &models.PathStatus{
+				Icmp: &models.ConnectivityStatus{Status: ""},
+				HTTP: &models.ConnectivityStatus{Status: ""},
+			},
+			expectedStatusType: ConnStatusReachable,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: &models.ConnectivityStatus{Status: "failed"},
+				HTTP: &models.ConnectivityStatus{Status: "failed"},
+			},
+			expectedStatusType: ConnStatusUnreachable,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: &models.ConnectivityStatus{Status: ""},
+				HTTP: &models.ConnectivityStatus{Status: "failed"},
+			},
+			expectedStatusType: ConnStatusUnreachable,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: &models.ConnectivityStatus{Status: "failed"},
+				HTTP: &models.ConnectivityStatus{Status: ""},
+			},
+			expectedStatusType: ConnStatusUnreachable,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: &models.ConnectivityStatus{Status: "failed"},
+				HTTP: nil,
+			},
+			expectedStatusType: ConnStatusUnreachable,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: nil,
+				HTTP: &models.ConnectivityStatus{Status: "failed"},
+			},
+			expectedStatusType: ConnStatusUnreachable,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: nil,
+				HTTP: nil,
+			},
+			expectedStatusType: ConnStatusUnknown,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: &models.ConnectivityStatus{Status: ""},
+				HTTP: nil,
+			},
+			expectedStatusType: ConnStatusUnknown,
+		},
+		{
+			cp: &models.PathStatus{
+				Icmp: nil,
+				HTTP: &models.ConnectivityStatus{Status: ""},
+			},
+			expectedStatusType: ConnStatusUnknown,
+		},
+	}
+	for _, tc := range tests {
+		c.Assert(GetPathConnectivityStatusType(tc.cp), Equals, tc.expectedStatusType)
+	}
+}
+
 func (s *ClientTestSuite) TestFormatNodeStatus(c *C) {
 	// This test generates permutations of models.NodeStatus and sees whether
 	// the calls to formatNodeStatus panic; the result of this test being
diff --git a/pkg/policy/distillery_test.go b/pkg/policy/distillery_test.go
index b020aa6e8e..72c4596268 100644
--- a/pkg/policy/distillery_test.go
+++ b/pkg/policy/distillery_test.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Authors of Cilium
+// Copyright 2019-2020 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -58,8 +58,8 @@ func (s *DistilleryTestSuite) TestCacheManagement(c *C) {
 	c.Assert(deleted, Equals, false)
 
 	// Insert identity twice. Should be the same policy.
-	policy1, _ := cache.insert(identity)
-	policy2, _ := cache.insert(identity)
+	policy1 := cache.insert(identity)
+	policy2 := cache.insert(identity)
 	c.Assert(policy1, Equals, policy2)
 
 	// Despite two insert calls, there is no reference tracking; any delete
@@ -75,11 +75,11 @@ func (s *DistilleryTestSuite) TestCacheManagement(c *C) {
 	ep3.SetIdentity(1234, true)
 	identity3 := ep3.GetSecurityIdentity()
 	c.Assert(identity3, Not(Equals), identity)
-	policy1, _ = cache.insert(identity)
-	policy3, _ := cache.insert(identity3)
+	policy1 = cache.insert(identity)
+	policy3 := cache.insert(identity3)
 	c.Assert(policy1, Not(Equals), policy3)
 	_ = cache.delete(identity)
-	policy3, _ = cache.lookupOrCreate(identity3, false)
+	policy3 = cache.lookupOrCreate(identity3, false)
 	c.Assert(policy3, NotNil)
 }
 
@@ -90,8 +90,7 @@ func (s *DistilleryTestSuite) TestCachePopulation(c *C) {
 
 	identity1 := ep1.GetSecurityIdentity()
 	c.Assert(ep2.GetSecurityIdentity(), Equals, identity1)
-	policy1, computed := cache.insert(identity1)
-	c.Assert(computed, Equals, false)
+	policy1 := cache.insert(identity1)
 
 	// Calculate the policy and observe that it's cached
 	updated, err := cache.updateSelectorPolicy(identity1)
@@ -100,8 +99,7 @@ func (s *DistilleryTestSuite) TestCachePopulation(c *C) {
 	updated, err = cache.updateSelectorPolicy(identity1)
 	c.Assert(err, IsNil)
 	c.Assert(updated, Equals, false)
-	policy2, computed := cache.insert(identity1)
-	c.Assert(computed, Equals, true)
+	policy2 := cache.insert(identity1)
 	idp1 := policy1.(*cachedSelectorPolicy).getPolicy()
 	idp2 := policy2.(*cachedSelectorPolicy).getPolicy()
 	c.Assert(idp1, Equals, idp2)
@@ -121,14 +119,12 @@ func (s *DistilleryTestSuite) TestCachePopulation(c *C) {
 
 	// Insert endpoint with different identity and observe that the cache
 	// is different from ep1, ep2
-	policy1, computed = cache.insert(identity1)
-	c.Assert(computed, Equals, false)
+	policy1 = cache.insert(identity1)
 	idp1 = policy1.(*cachedSelectorPolicy).getPolicy()
 	c.Assert(idp1, NotNil)
 	identity3 := ep3.GetSecurityIdentity()
-	policy3, computed := cache.insert(identity3)
+	policy3 := cache.insert(identity3)
 	c.Assert(policy3, Not(Equals), policy1)
-	c.Assert(computed, Equals, false)
 	updated, err = cache.updateSelectorPolicy(identity3)
 	c.Assert(err, IsNil)
 	c.Assert(updated, Equals, true)
diff --git a/pkg/proxy/mock_test.go b/pkg/proxy/mock_test.go
index a7341a24ad..4e5fb345bc 100644
--- a/pkg/proxy/mock_test.go
+++ b/pkg/proxy/mock_test.go
@@ -1,4 +1,4 @@
-// Copyright 2017-2019 Authors of Cilium
+// Copyright 2017-2020 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -45,8 +45,6 @@ func (m *proxyUpdaterMock) GetID() uint64                               { return
 func (m *proxyUpdaterMock) GetIPv4Address() string                      { return m.ipv4 }
 func (m *proxyUpdaterMock) GetIPv6Address() string                      { return m.ipv6 }
 func (m *proxyUpdaterMock) GetLabels() []string                         { return m.labels }
-func (m *proxyUpdaterMock) GetEgressPolicyEnabledLocked() bool          { return true }
-func (m *proxyUpdaterMock) GetIngressPolicyEnabledLocked() bool         { return true }
 func (m *proxyUpdaterMock) GetIdentityLocked() identity.NumericIdentity { return m.identity }
 func (m *proxyUpdaterMock) ProxyID(npMap policy.NamedPortsMap, l4 *policy.L4Filter) (string, error) {
 	return "", nil
diff --git a/test/k8sT/istio.go b/test/k8sT/istio.go
index 43369075c5..5396b07c44 100644
--- a/test/k8sT/istio.go
+++ b/test/k8sT/istio.go
@@ -139,9 +139,7 @@ var _ = Describe("K8sIstioTest", func() {
 	})
 
 	AfterFailed(func() {
-		kubectl.CiliumReport(helpers.CiliumNamespace,
-			"cilium endpoint list",
-			"cilium bpf proxy list")
+		kubectl.CiliumReport(helpers.CiliumNamespace, "cilium endpoint list")
 	})
 
 	// This is defined as a separate function to be called from the test below