CORENET-5972: Add openvswitch-ipsec package into ipsec plugin - #4878
Conversation
|
/retest-required |
1 similar comment
|
/retest-required |
e71356f to
d7215d0
Compare
|
/assign @igsilya |
pperiyasamy
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@pperiyasamy: This pull request references SDN-5330 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
be4805f to
752fd3c
Compare
|
/assign @jcaamano |
|
/retest |
752fd3c to
3b34da7
Compare
|
/assign @huiran0826 @anuragthehatter @tssurya |
|
@pperiyasamy: This pull request references SDN-5330 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3b34da7 to
7c78630
Compare
| if systemctl is-active --quiet $ovsipsecsvc; then | ||
| # When openvswitch-ipsec.service is active (i.e. IPsec is enabled for | ||
| # east west traffic), the service may be just started before | ||
| # wait-for-ipsec-connect.service, it may take a while to populate | ||
| # /etc/ipsec.d/openshift.conf with IPsec connection entries. | ||
| # so retrieve connection names from ovs. | ||
| desiredconn=$(ovs-vsctl --columns=name find interface type=geneve | awk -F': ' '/name/ {print $2}' | sort | awk '{print $0"-in-1", $0"-out-1"}' | tr '\n' ' ') | ||
| else | ||
| desiredconn=$(grep -E '^\s*conn\s+' /etc/ipsec.d/openshift.conf | grep -v '%default' | awk '{print $2}' | tr ' ' '\n' | sort | tr '\n' ' ') | ||
| fi |
There was a problem hiding this comment.
The ovs-vsctl method should work in both cases, so maybe just always use it instead of parsing openshift.conf?
There was a problem hiding this comment.
@igsilya when ipsec is disabled, openvswitch-ipsec.service is stopped, openvswitch3.5-ipsec package is removed, but /etc/ipsec.d/openshift.conf file is not removed (though file doesn't have ipsec conn entries). so using ovs-vsctl method would just unnecessarily checking for established ipsec connections for 60s which is not configured anyway. that is the reason parsing openshift.conf for this case.
now thinking about moving from Full->External ipsec scenario, node will keep openvswitch-ipsec.service running, script uses ovs-vsctl method and unnecessarily adds 60s delay.
There was a problem hiding this comment.
If ipsec is disabled in OVN, then those tunnels should not have ipsec configuration. Can we filter by remote_cert being non-empty, for example? Something like:
ovs-vsctl --columns=name find interface type=geneve options:remote_cert!='""'
?
There was a problem hiding this comment.
yes @igsilya, filtering tunnels on remote_name would handle both cases, thanks ! updated the script.
c8463d1 to
969b039
Compare
|
/retest |
6b8d976 to
c04cebe
Compare
|
/pipeline required |
|
Scheduling tests matching the |
|
@pperiyasamy I'm not an expert in the extension packages management parts, but the systemd service related code seems correct to me, if we're OK with the oneshot waiting service reported as failed in relatively common cases (multi-node reboots). |
|
lgtm |
|
/retest |
The ipsec os extension is updated to install openvswitch3.5-ipsec package in addition to libreswan and NetworkManager-libreswan packages, so this commit updates supported extension map with openvswitch-ipsec package. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
The openvswitch-ipsec service must be started only after ipsec.service and it has to be up before crio and kubelet service, so add appropriate systemd service dependencies for openvswitch-ipsec.service. It also removes a workaround that was needed in ipsec-connect-wait script to explicitly trigger pluto to establish IPSec IKE SAs with peer nodes when openvswitch-ipsec.service is already running on the node. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
When openvswith-ipsec systemd service is already configured for OVN, then let wait-for-ipsec-connect.service start it immediately and then start waiting for IKE SA to be established. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
Add openvswitch3.5-ipsec to the ipsec extension and implement graceful handling of extension package changes during upgrade. During an upgrade, the new MCD code may roll out before the OS image update. If an extension’s package list has changed, this creates a window where the new MCD expects packages that aren’t yet installed, causing nodes to become degraded. Introduce LegacyExtensionPackages() to track previous package lists and modify verification logic to accept either current or legacy package sets. This allows nodes to pass verification during the upgrade transition period. AssistedBy: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
c04cebe to
dd59b42
Compare
|
/lgtm |
|
Scheduling tests matching the |
|
I have no power in this repo, but /lgtm as well. |
|
/retest |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: djoshy, igsilya, jcaamano, pperiyasamy The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/verified in ci |
|
@pperiyasamy: The DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/verified by ci |
openshift-ci-robot
added
the
verified
|
@pperiyasamy: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@pperiyasamy: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retest-required |
10 participants
This PR adds openvswitch3.5-ipsec package support to the ipsec os extension and ensures it integrates correctly for both node install and upgrade scenarios.
LegacyExtensionPackages()to track prior package lists for extensions whose packages changed from 4.x to 5.x. During upgrade, the new MCD pod may roll out before the OS image update, verification logic now accepts either the current or legacy package set, preventing nodes from degrading during the transition.Summary by CodeRabbit
Bug Fixes
openshift.conf.openvswitch3.5-ipsecoption.Tests