SDN-5330: Wait enough for IPsec tunnels to establish before kubelet start - #2606
SDN-5330: Wait enough for IPsec tunnels to establish before kubelet start#2606pperiyasamy wants to merge 2 commits into
Conversation
|
/test e2e-aws-ovn-ipsec-upgrade |
|
somehow |
|
/test e2e-aws-ovn-ipsec-upgrade |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: pperiyasamy The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
3c4cbbd to
5a0f0e0
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
1 similar comment
|
/test e2e-aws-ovn-ipsec-upgrade |
5b24c74 to
6566cf0
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
6566cf0 to
c7c8d24
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
c7c8d24 to
bb48347
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
pperiyasamy
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@pperiyasamy: This pull request references SDN-5330 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
bb48347 to
aba1a89
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
aba1a89 to
801abcc
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
801abcc to
8d0db5b
Compare
|
/test e2e-aws-ovn-ipsec-serial |
1 similar comment
|
/test e2e-aws-ovn-ipsec-serial |
|
/testwith openshift/cluster-network-operator/master/e2e-ovn-ipsec-step-registry openshift/origin#29437 |
|
The |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
1 similar comment
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
8d0db5b to
9b83a83
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
2 similar comments
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
|
/testwith openshift/cluster-network-operator/master/e2e-ovn-ipsec-step-registry openshift/origin#29232 |
|
/test e2e-aws-ovn-ipsec-upgrade |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
|
/testwith openshift/cluster-network-operator/master/e2e-ovn-ipsec-step-registry openshift/origin#29232 |
|
/test e2e-aws-ovn-ipsec-upgrade |
|
/testwith openshift/cluster-network-operator/master/e2e-ovn-ipsec-step-registry openshift/origin#29232 |
c44c4d6 to
1a6f3da
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
1a6f3da to
b1aec41
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
|
/test e2e-aws-ovn-ipsec-upgrade |
When node goes for a reboot on an IPsec enabled cluster, once it comes up, libreswan parses /etc/ipsec.d/openshift.conf file and establishes SAs with peers and it may be still in progress even after kubelet is started, pod scheduled on this node would fail communicating with other pods until IPsec tunnels are established. So this commit makes ipsecenabler systemd service to wait upto 2 minutes until IPsec tunnels are established and this would give better chance for ipsec CI lanes to run fine without disruptive events. The butane configs are translated into machine configs with command `butane <file>.bu -o <file>.yaml` and only storage portion is copied manually into IPsec machine config files. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
b1aec41 to
7d35250
Compare
|
/test e2e-aws-ovn-ipsec-upgrade |
|
/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-ipsec-serial openshift/origin#29437 |
|
@pperiyasamy: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/testwith openshift/cluster-network-operator/master/e2e-ovn-ipsec-step-registry openshift/origin#29232 |
|
Closing this in favor of openshift/machine-config-operator#4854. The MCO PR optimizes things with single node reboot during ipsec upgrade. |
4 participants
When node goes for a reboot on an IPsec enabled cluster, once it comes up, libreswan parses /etc/ipsec.d/openshift.conf file and establishes SAs with peers and it may be still in progress even after kubelet is started, pod scheduled on this node would fail communicating with other pods until IPsec tunnels are established. So this commit makes ipsecenabler systemd service to wait upto 2 minutes until IPsec tunnels are established and this would give better chance for ipsec CI lanes to run fine without disruptive events.
The butane configs are translated into machine configs with command
butane <file>.bu -o <file>.yamland only storage portion is copied manually into IPsec machine config files.