Keep ovn ipsec enabled during the upgrade

It's noticed that ipsec option is ovn is disabled when ipsec daemonset is not running
due to known reasons, but it's disabling ipsec in ovn which causes ovs-monitor-ipsec
to refresh exisiting ipsec connections unnecessarily as it is not able to find
remote_name from tunnel. so this commit enables ovn ipsec option as long as API is
set with Full mode.

Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>

Author: pperiyasamy

pkg/network/ovn_kubernetes.go

@@ -671,7 +671,7 @@ func shouldRenderIPsec(conf *operv1.OVNKubernetesConfig, bootstrapResult *bootst
 	// We render OVN IPsec if East-West IPsec is enabled or it's upgrade is in progress.
 	// If NS IPsec is enabled as well, we need to wait to IPsec MachineConfig
 	// to be active if it's not an upgrade and not a hypershift hosted cluster.
-	renderIPsecOVN = (renderIPsecHostDaemonSet || renderIPsecContainerizedDaemonSet) && mode == operv1.IPsecModeFull
+	renderIPsecOVN = mode == operv1.IPsecModeFull
 
 	// While OVN ipsec is being upgraded and IPsec MachineConfigs deployment is in progress
 	// (or) IPsec config in OVN is being disabled, then ipsec deployment is not updated.

pkg/network/ovn_kubernetes_test.go

@@ -3322,13 +3322,13 @@ func TestRenderOVNKubernetesEnableIPsecWithUserInstalledIPsecMachineConfigs(t *t
 	if renderedIPsec != nil {
 		t.Errorf("ovn-ipsec-host DaemonSet must not exist, but it's available")
 	}
-	// Ensure ovnkube-node DaemonSet exists without ipsec-enabled annotation.
+	// Ensure ovnkube-node DaemonSet exists with ipsec-enabled annotation.
 	renderedNode := findInObjs("apps", "DaemonSet", "ovnkube-node", "openshift-ovn-kubernetes", objs)
 	if renderedNode == nil {
 		t.Errorf("ovnkube-node DaemonSet must exist, but it's not available")
 	}
-	if _, ok := renderedNode.GetAnnotations()[names.IPsecEnableAnnotation]; ok {
-		t.Errorf("ovn-ipsec DaemonSet should not have ipsec-enabled annotation, but it does %v", renderedNode)
+	if _, ok := renderedNode.GetAnnotations()[names.IPsecEnableAnnotation]; !ok {
+		t.Errorf("ovnkube-node DaemonSet should have ipsec-enabled annotation, but it does not %v", renderedNode)
 	}
 
 	// Step 2: Check renderOVNKubernetes behavior after user defined machine configs rollout is complete.
@@ -3361,7 +3361,7 @@ func TestRenderOVNKubernetesEnableIPsecWithUserInstalledIPsecMachineConfigs(t *t
 		t.Errorf("ovnkube-node DaemonSet must exist, but it's not available")
 	}
 	if _, ok := renderedNode.GetAnnotations()[names.IPsecEnableAnnotation]; !ok {
-		t.Errorf("ovn-ipsec DaemonSet should have ipsec-enabled annotation, but it doesn't %v", renderedNode)
+		t.Errorf("ovnkube-node DaemonSet should have ipsec-enabled annotation, but it doesn't %v", renderedNode)
 	}
 }