Skip to content

OCPBUGS-40906: Implement IPsec NAT-Traversal encapsulation option - #2573

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:masterfrom
pperiyasamy:ipsec-nat-t-feature
Apr 24, 2025
Merged

OCPBUGS-40906: Implement IPsec NAT-Traversal encapsulation option#2573
openshift-merge-bot[bot] merged 1 commit into
openshift:masterfrom
pperiyasamy:ipsec-nat-t-feature

Conversation

@pperiyasamy

@pperiyasamy pperiyasamy commented Nov 21, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

There is a requirement to encapsulate IPsec east west traffic in UDP via NAT-T so that those packets are compatible with intermediate NAT device(s) if present. This PR consumes new API to enable or disable encap option and applies to
OVN to configure east west ipsec tunnel connections accordingly.

API PRs:
openshift/api#1472
openshift/api#2199

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Nov 21, 2024
@openshift-ci-robot

openshift-ci-robot commented Nov 21, 2024

Copy link
Copy Markdown
Contributor

@pperiyasamy: This pull request references Jira Issue OCPBUGS-40906, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.18.0) matches configured target version for branch (4.18.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

There is a requirement to encapsulate IPsec east west traffic in UDP via NAT-T so that those packets are compatible with intermediate NAT device(s) if present. This commit consumes new API to enable or disable encap option and applies to
OVN to configure east west ipsec tunnel connections accordingly.

Depends on: openshift/api#1472

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@pperiyasamy
pperiyasamy marked this pull request as draft November 21, 2024 13:32
@openshift-ci
openshift-ci Bot requested review from dougbtv and kyrtapz November 21, 2024 13:32
@pperiyasamy pperiyasamy mentioned this pull request Nov 21, 2024
Merged
@openshift-ci-robot

openshift-ci-robot commented Nov 21, 2024

Copy link
Copy Markdown
Contributor

@pperiyasamy: This pull request references Jira Issue OCPBUGS-40906, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.18.0) matches configured target version for branch (4.18.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

There is a requirement to encapsulate IPsec east west traffic in UDP via NAT-T so that those packets are compatible with intermediate NAT device(s) if present. This PR consumes new API to enable or disable encap option and applies to
OVN to configure east west ipsec tunnel connections accordingly.

Depends on: openshift/api#1472

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 21, 2024
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 18, 2024
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 18, 2024
@openshift-ci-robot openshift-ci-robot added jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. and removed jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Dec 18, 2024
@openshift-ci-robot

openshift-ci-robot commented Dec 18, 2024

Copy link
Copy Markdown
Contributor

@pperiyasamy: This pull request references Jira Issue OCPBUGS-40906, which is invalid:

  • expected the bug to target either version "4.19." or "openshift-4.19.", but it targets "4.18.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

There is a requirement to encapsulate IPsec east west traffic in UDP via NAT-T so that those packets are compatible with intermediate NAT device(s) if present. This PR consumes new API to enable or disable encap option and applies to
OVN to configure east west ipsec tunnel connections accordingly.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@pperiyasamy
pperiyasamy marked this pull request as ready for review December 18, 2024 16:53
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 18, 2024
@openshift-ci
openshift-ci Bot requested a review from abhat December 18, 2024 16:54
@pperiyasamy

pperiyasamy commented Dec 18, 2024

Copy link
Copy Markdown
Member Author

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Dec 18, 2024
@openshift-ci-robot

openshift-ci-robot commented Dec 18, 2024

Copy link
Copy Markdown
Contributor

@pperiyasamy: This pull request references Jira Issue OCPBUGS-40906, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.19.0) matches configured target version for branch (4.19.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@pperiyasamy

pperiyasamy commented Jan 7, 2025

Copy link
Copy Markdown
Member Author

/retest

@pperiyasamy

pperiyasamy commented Jan 7, 2025

Copy link
Copy Markdown
Member Author

/assign @jcaamano @trozet @huiran0826

@pperiyasamy

pperiyasamy commented Jan 8, 2025

Copy link
Copy Markdown
Member Author

/testwith openshift/origin#29232

@zenghui-shi

zenghui-shi commented Apr 18, 2025

Copy link
Copy Markdown
Contributor

/retest-required

2 similar comments
@ricky-rav

ricky-rav commented Apr 18, 2025

Copy link
Copy Markdown

/retest-required

@ricky-rav

ricky-rav commented Apr 18, 2025

Copy link
Copy Markdown

/retest-required

@openshift-ci-robot

openshift-ci-robot commented Apr 18, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 50405c0 and 2 for PR HEAD 50899e2 in total

@ricky-rav

ricky-rav commented Apr 18, 2025

Copy link
Copy Markdown

/retest-required

1 similar comment
@ricky-rav

ricky-rav commented Apr 18, 2025

Copy link
Copy Markdown

/retest-required

@openshift-ci-robot

openshift-ci-robot commented Apr 18, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0aaa7d and 1 for PR HEAD 50899e2 in total

@zenghui-shi

zenghui-shi commented Apr 21, 2025

Copy link
Copy Markdown
Contributor

/retest-required

1 similar comment
@pperiyasamy

pperiyasamy commented Apr 22, 2025

Copy link
Copy Markdown
Member Author

/retest-required

@openshift-ci-robot

openshift-ci-robot commented Apr 22, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0aaa7d and 2 for PR HEAD 50899e2 in total

@openshift-ci-robot

openshift-ci-robot commented Apr 22, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 6268c4e and 1 for PR HEAD 50899e2 in total

@openshift-ci-robot

openshift-ci-robot commented Apr 22, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 6268c4e and 2 for PR HEAD 50899e2 in total

@jcaamano

jcaamano commented Apr 23, 2025

Copy link
Copy Markdown
Contributor

/retest-required

@jcaamano

jcaamano commented Apr 23, 2025

Copy link
Copy Markdown
Contributor

/override ci/prow/e2e-aws-ovn-windows

perma-failing due to https://issues.redhat.com/browse/WINC-1384

@openshift-ci

openshift-ci Bot commented Apr 23, 2025

Copy link
Copy Markdown
Contributor

@jcaamano: Overrode contexts on behalf of jcaamano: ci/prow/e2e-aws-ovn-windows

Details

In response to this:

/override ci/prow/e2e-aws-ovn-windows

perma-failing due to https://issues.redhat.com/browse/WINC-1384

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot

openshift-ci-robot commented Apr 23, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD bcf7b32 and 1 for PR HEAD 50899e2 in total

@jcaamano

jcaamano commented Apr 23, 2025

Copy link
Copy Markdown
Contributor

/retest-required

@openshift-ci-robot

openshift-ci-robot commented Apr 23, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 6f02e29 and 0 for PR HEAD 50899e2 in total

@openshift-ci-robot

openshift-ci-robot commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 6f02e29 and 2 for PR HEAD 50899e2 in total

@pperiyasamy

pperiyasamy commented Apr 24, 2025

Copy link
Copy Markdown
Member Author

/retest-required

@openshift-ci

openshift-ci Bot commented Apr 24, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

@pperiyasamy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/4.18-upgrade-from-stable-4.17-e2e-azure-ovn-upgrade ff55dc6 link false /test 4.18-upgrade-from-stable-4.17-e2e-azure-ovn-upgrade
ci/prow/e2e-vsphere-ovn-dualstack-primaryv6 50899e2 link false /test e2e-vsphere-ovn-dualstack-primaryv6
ci/prow/e2e-aws-hypershift-ovn-kubevirt 50899e2 link false /test e2e-aws-hypershift-ovn-kubevirt
ci/prow/security 50899e2 link false /test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@pperiyasamy

pperiyasamy commented Apr 24, 2025

Copy link
Copy Markdown
Member Author

/test e2e-aws-ovn-ipsec-upgrade

@openshift-ci-robot

openshift-ci-robot commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 6f02e29 and 2 for PR HEAD 50899e2 in total

@jcaamano

jcaamano commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

/override ci/prow/e2e-aws-ovn-windows

@openshift-ci

openshift-ci Bot commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

@jcaamano: Overrode contexts on behalf of jcaamano: ci/prow/e2e-aws-ovn-windows

Details

In response to this:

/override ci/prow/e2e-aws-ovn-windows

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 558108a into openshift:master Apr 24, 2025
@openshift-ci-robot

openshift-ci-robot commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

@pperiyasamy: Jira Issue OCPBUGS-40906: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-40906 has been moved to the MODIFIED state.

Details

In response to this:

There is a requirement to encapsulate IPsec east west traffic in UDP via NAT-T so that those packets are compatible with intermediate NAT device(s) if present. This PR consumes new API to enable or disable encap option and applies to
OVN to configure east west ipsec tunnel connections accordingly.

API PRs:
openshift/api#1472
openshift/api#2199

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot

openshift-merge-robot commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

Fix included in accepted release 4.19.0-0.nightly-2025-04-04-170728

@openshift-bot

openshift-bot commented Apr 24, 2025

Copy link
Copy Markdown
Contributor

[ART PR BUILD NOTIFIER]

Distgit: cluster-network-operator
This PR has been included in build cluster-network-operator-container-v4.20.0-202504241659.p0.g558108a.assembly.stream.el9.
All builds following this will include this PR.

@openshift-ci-robot openshift-ci-robot mentioned this pull request Jul 14, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dougbtv dougbtv Awaiting requested review from dougbtv
@kyrtapz kyrtapz Awaiting requested review from kyrtapz
@abhat abhat Awaiting requested review from abhat
3 more reviewers
@martinkennelly martinkennelly martinkennelly left review comments
@huiran0826 huiran0826 huiran0826 left review comments
@trozet trozet trozet approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@jluhrsen jluhrsen

@trozet trozet

@martinkennelly martinkennelly

@jcaamano jcaamano

@huiran0826 huiran0826

@asood-rh asood-rh

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.