[complexity-test] tune the included LLVM version to match Cilium minor release

[julianwiedmann]

Background:
Cilium uses the complexity-test image to test the building & loading of various BPF datapath programs. For a specific minor version of Cilium, the image should use the corresponding LLVM version. With Cilium v1.16 we bumped the included LLVM from v10 to v17, and this commit pulled LLVM v17 into the complexity-test image. Now pulling the latest complexity-test image into CI for eg. Cilium v1.15 means that we would test with LLVM v17, even though Cilium v1.15 actually still uses LLVM v10 to build its BPF programs.

Proposal:
Build Cilium minor-specific variants of complexity-test, which pull in the LLVM version of that minor release.

[julianwiedmann]

@gentoo-root fyi

[gentoo-root]

Any drawbacks if we just stop updating the complexity-test image in stable branches? I guess there may be some improvements to the image itself (other than updating LLVM) that we need to pick in the CI?

[julianwiedmann]

Any drawbacks if we just stop updating the complexity-test image in stable branches? I guess there may be some improvements to the image itself (other than updating LLVM) that we need to pick in the CI?

We would stop covering the patch bumps of the tested kernel versions. IIRC Cilium did have regressions in the past, due to backported verifier changes that caused programs to be rejected.

[gentoo-root]

patch bumps of the tested kernel versions

Yeah, I agree, this is important, I saw it too: I can't upgrade to LLVM 18, because we need to pick some kernel patches, but the upgraded kernel causes regressions in the CI: cilium/cilium#33927