diff -crB --new-file cilium-1.6.6-backup/Documentation/cmdref/cilium-agent.md cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/Documentation/cmdref/cilium-agent.md
*** cilium-1.6.6-backup/Documentation/cmdref/cilium-agent.md	2020-02-03 14:04:55.000000000 -0800
--- cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/Documentation/cmdref/cilium-agent.md	2020-05-03 21:24:44.029591916 -0700
***************
*** 24,37 ****
        --blacklist-conflicting-routes                          Don't blacklist IP allocations conflicting with local non-cilium routes (default true)
        --bpf-compile-debug                                     Enable debugging of the BPF compilation process
        --bpf-ct-global-any-max int                             Maximum number of entries in non-TCP CT table (default 262144)
!       --bpf-ct-global-tcp-max int                             Maximum number of entries in TCP CT table (default 1000000)
        --bpf-ct-timeout-regular-any duration                   Timeout for entries in non-TCP CT table (default 1m0s)
        --bpf-ct-timeout-regular-tcp duration                   Timeout for established entries in TCP CT table (default 6h0m0s)
        --bpf-ct-timeout-regular-tcp-fin duration               Teardown timeout for entries in TCP CT table (default 10s)
        --bpf-ct-timeout-regular-tcp-syn duration               Establishment timeout for entries in TCP CT table (default 1m0s)
        --bpf-ct-timeout-service-any duration                   Timeout for service entries in non-TCP CT table (default 1m0s)
        --bpf-ct-timeout-service-tcp duration                   Timeout for established service entries in TCP CT table (default 6h0m0s)
!       --bpf-nat-global-max int                                Maximum number of entries for the global BPF NAT table (default 841429)
        --bpf-policy-map-max int                                Maximum number of entries in endpoint policy map (per endpoint) (default 16384)
        --bpf-root string                                       Path to BPF filesystem
        --cgroup-root string                                    Path to Cgroup2 filesystem
--- 24,37 ----
        --blacklist-conflicting-routes                          Don't blacklist IP allocations conflicting with local non-cilium routes (default true)
        --bpf-compile-debug                                     Enable debugging of the BPF compilation process
        --bpf-ct-global-any-max int                             Maximum number of entries in non-TCP CT table (default 262144)
!       --bpf-ct-global-tcp-max int                             Maximum number of entries in TCP CT table (default 524288)
        --bpf-ct-timeout-regular-any duration                   Timeout for entries in non-TCP CT table (default 1m0s)
        --bpf-ct-timeout-regular-tcp duration                   Timeout for established entries in TCP CT table (default 6h0m0s)
        --bpf-ct-timeout-regular-tcp-fin duration               Teardown timeout for entries in TCP CT table (default 10s)
        --bpf-ct-timeout-regular-tcp-syn duration               Establishment timeout for entries in TCP CT table (default 1m0s)
        --bpf-ct-timeout-service-any duration                   Timeout for service entries in non-TCP CT table (default 1m0s)
        --bpf-ct-timeout-service-tcp duration                   Timeout for established service entries in TCP CT table (default 6h0m0s)
!       --bpf-nat-global-max int                                Maximum number of entries for the global BPF NAT table (default 524288)
        --bpf-policy-map-max int                                Maximum number of entries in endpoint policy map (per endpoint) (default 16384)
        --bpf-root string                                       Path to BPF filesystem
        --cgroup-root string                                    Path to Cgroup2 filesystem
diff -crB --new-file cilium-1.6.6-backup/Documentation/install/upgrade.rst cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/Documentation/install/upgrade.rst
*** cilium-1.6.6-backup/Documentation/install/upgrade.rst	2020-02-03 14:04:55.000000000 -0800
--- cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/Documentation/install/upgrade.rst	2020-05-03 21:24:44.029591916 -0700
***************
*** 278,283 ****
--- 278,370 ----
     the latest v1.5.x point release to minimize disruption of service
     connections during upgrade.
  
+ * Since Cilium 1.5, the TCP connection tracking table size parameter
+   ``bpf-ct-global-tcp-max`` in the daemon was set to the default value
+   ``1000000`` to retain backwards compatibility with previous versions. In
+   Cilium 1.6 the default value is set to 512K by default in order to reduce the
+   agent memory consumption.
+ 
+   If Cilium was deployed using Helm, the new default value of 512K was already
+   effective in Cilium 1.6 or later, unless it was manually configured to a
+   different value.
+ 
+   If the table size was configured to a value different from 512K in the
+   previous installation, ongoing connections will be disrupted during the
+   upgrade. To avoid connection breakage, ``bpf-ct-global-tcp-max`` needs to be
+   manually adjusted.
+ 
+   To check whether any action is required the following command can be used to
+   check the currently configured maximum number of TCP conntrack entries:
+ 
+   .. code:: bash
+      sudo grep -R CT_MAP_SIZE_TCP /var/run/cilium/state/templates/
+   If the maximum number is 524288, no action is required. If the number is
+   different, ``bpf-ct-global-tcp-max`` needs to be adjusted in the `ConfigMap`
+   to the value shown by the command above (100000 in the example below):
+ 
+ .. tabs::
+   .. group-tab:: kubectl
+ 
+     .. parsed-literal::
+ 
+       helm template cilium \\
+       --namespace=kube-system \\
+       ...
+       --set global.bpf.ctTcpMax=100000
+       ...
+       > cilium.yaml
+       kubectl apply -f cilium.yaml
+ 
+   .. group-tab:: Helm
+ 
+     .. parsed-literal::
+ 
+       helm upgrade cilium --namespace=kube-system \\
+       --set global.bpf.ctTcpMax=100000
+ 
+ * The default value for the NAT table size parameter ``bpf-nat-global-max`` in
+   the daemon is derived from the default value of the conntrack table size
+   parameter ``bpf-ct-global-tcp-max``. Since the latter was changed (see
+   above), the default NAT table size decreased from ~820K to 512K.
+ 
+   The NAT table is only used if either BPF NodePort (``enable-node-port``
+   parameter) or masquerading (``masquerade`` parameter) are enabled. No action
+   is required if neither of the parameters is enabled.
+ 
+   If either of the parameters is enabled, ongoing connections will be disrupted
+   during the upgrade. In order to avoid connection breakage,
+   ``bpf-nat-global-max`` needs to be manually adjusted.
+ 
+   To check whether any adjustment is required the following command can be used
+   to check the currently configured maximum number of NAT table entries:
+ 
+   .. code:: bash
+      sudo grep -R SNAT_MAPPING_IPV[46]_SIZE /var/run/cilium/state/globals/
+   If the command does not return any value or if the returned maximum number is
+   524288, no action is required. If the number is different,
+   ``bpf-nat-global-max`` needs to be adjusted in the `ConfigMap` to the value
+   shown by the command above (841429 in the example below):
+ 
+ .. tabs::
+   .. group-tab:: kubectl
+ 
+     .. parsed-literal::
+ 
+       helm template cilium \\
+       --namespace=kube-system \\
+       ...
+       --set global.bpf.natMax=841429
+       ...
+       > cilium.yaml
+       kubectl apply -f cilium.yaml
+ 
+   .. group-tab:: Helm
+ 
+     .. parsed-literal::
+ 
+       helm upgrade cilium --namespace=kube-system \\
+       --set global.bpf.natMax=841429
+ 
  Changes that may require action
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
diff -crB --new-file cilium-1.6.6-backup/install/kubernetes/cilium/charts/config/templates/configmap.yaml cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/install/kubernetes/cilium/charts/config/templates/configmap.yaml
*** cilium-1.6.6-backup/install/kubernetes/cilium/charts/config/templates/configmap.yaml	2020-05-03 20:01:58.281991275 -0700
--- cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/install/kubernetes/cilium/charts/config/templates/configmap.yaml	2020-05-03 21:24:44.029591916 -0700
***************
*** 102,108 ****
    # that will be seen in monitor output.
    monitor-aggregation: {{ .Values.global.bpf.monitorAggregation }}
  
!   # ct-global-max-entries-* specifies the maximum number of connections
    # supported across all endpoints, split by protocol: tcp or other. One pair
    # of maps uses these values for IPv4 connections, and another pair of maps
    # use these values for IPv6 connections.
--- 102,108 ----
    # that will be seen in monitor output.
    monitor-aggregation: {{ .Values.global.bpf.monitorAggregation }}
  
!   # bpf-ct-global-*-max specifies the maximum number of connections
    # supported across all endpoints, split by protocol: tcp or other. One pair
    # of maps uses these values for IPv4 connections, and another pair of maps
    # use these values for IPv6 connections.
***************
*** 112,118 ****
    # policy drops or a change in loadbalancing decisions for a connection.
    #
    # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
!   # during the upgrade process, comment out these options.
    bpf-ct-global-tcp-max: "{{ .Values.global.bpf.ctTcpMax }}"
    bpf-ct-global-any-max: "{{ .Values.global.bpf.ctAnyMax }}"
  
--- 112,118 ----
    # policy drops or a change in loadbalancing decisions for a connection.
    #
    # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
!   # during the upgrade process, set bpf-ct-global-tcp-max to 1000000.
    bpf-ct-global-tcp-max: "{{ .Values.global.bpf.ctTcpMax }}"
    bpf-ct-global-any-max: "{{ .Values.global.bpf.ctAnyMax }}"
  
diff -crB --new-file cilium-1.6.6-backup/install/kubernetes/cilium/values.yaml cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/install/kubernetes/cilium/values.yaml
*** cilium-1.6.6-backup/install/kubernetes/cilium/values.yaml	2020-05-03 20:01:58.281991275 -0700
--- cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/install/kubernetes/cilium/values.yaml	2020-05-03 21:24:44.029591916 -0700
***************
*** 184,190 ****
      ctAnyMax: 262144
  
      # natMax is the maximum number of entries for the NAT table
!     natMax: 841429
  
      # montiorAggregation is the level of aggregation for datapath trace events
      monitorAggregation: medium
--- 184,190 ----
      ctAnyMax: 262144
  
      # natMax is the maximum number of entries for the NAT table
!     natMax: 524288 
  
      # montiorAggregation is the level of aggregation for datapath trace events
      monitorAggregation: medium
diff -crB --new-file cilium-1.6.6-backup/install/kubernetes/quick-install.yaml cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/install/kubernetes/quick-install.yaml
*** cilium-1.6.6-backup/install/kubernetes/quick-install.yaml	2020-05-03 20:01:58.281991275 -0700
--- cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/install/kubernetes/quick-install.yaml	2020-05-03 21:24:44.029591916 -0700
***************
*** 45,57 ****
    # policy drops or a change in loadbalancing decisions for a connection.
    #
    # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
!   # during the upgrade process, comment out these options.
    bpf-ct-global-tcp-max: "524288"
    bpf-ct-global-any-max: "262144"
  
    # bpf-nat-global-max specified the maximum number of entries in the BPF NAT
    # table.
!   bpf-nat-global-max: "841429"
  
    # Pre-allocation of map entries allows per-packet latency to be reduced, at
    # the expense of up-front memory allocation for the entries in the maps. The
--- 45,57 ----
    # policy drops or a change in loadbalancing decisions for a connection.
    #
    # For users upgrading from Cilium 1.2 or earlier, to minimize disruption
!   # during the upgrade process, set bpf-ct-global-tcp-max to 1000000. 
    bpf-ct-global-tcp-max: "524288"
    bpf-ct-global-any-max: "262144"
  
    # bpf-nat-global-max specified the maximum number of entries in the BPF NAT
    # table.
!   bpf-nat-global-max: "524288"
  
    # Pre-allocation of map entries allows per-packet latency to be reduced, at
    # the expense of up-front memory allocation for the entries in the maps. The
diff -crB --new-file cilium-1.6.6-backup/pkg/option/config.go cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/pkg/option/config.go
*** cilium-1.6.6-backup/pkg/option/config.go	2020-05-03 20:01:58.277991253 -0700
--- cilium-1.6.6-reduce-default-number-of-TCP-CT-and-NAT/pkg/option/config.go	2020-05-03 21:24:44.029591916 -0700
***************
*** 390,396 ****
  
  	// CTMapEntriesGlobalTCP retains the Cilium 1.2 (or earlier) size to
  	// minimize disruption during upgrade.
! 	CTMapEntriesGlobalTCPDefault = 1000000
  	CTMapEntriesGlobalAnyDefault = 2 << 17 // 256Ki
  	CTMapEntriesGlobalTCPName    = "bpf-ct-global-tcp-max"
  	CTMapEntriesGlobalAnyName    = "bpf-ct-global-any-max"
--- 390,396 ----
  
  	// CTMapEntriesGlobalTCP retains the Cilium 1.2 (or earlier) size to
  	// minimize disruption during upgrade.
! 	CTMapEntriesGlobalTCPDefault = 2 << 18 // 512Ki
  	CTMapEntriesGlobalAnyDefault = 2 << 17 // 256Ki
  	CTMapEntriesGlobalTCPName    = "bpf-ct-global-tcp-max"
  	CTMapEntriesGlobalAnyName    = "bpf-ct-global-any-max"
