SDN-5330: Add openvswitch-ipsec package for ipsec plugin #1718
Conversation
|
/assign @trozet @zshi-redhat |
|
/retest |
|
Can you clarify what this package brings / why it is needed? |
|
To be clear, this package is inert unless the systemd service is enabled, right? Any upgrading cluster with the |
pperiyasamy
force-pushed
the
add-openvswitch-ipsec
branch
from
83249fb to
5212a25
Compare
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
pperiyasamy
force-pushed
the
add-openvswitch-ipsec
branch
from
5212a25 to
2a27e82
Compare
@travier update the PR description with more details. hope that helps. |
yes @jlebon this service would be enabled only when ipsec extension is deployed. I would be testing this with few more dependent PRs in cluster-network-operator and ovn-kubernetes, Would come back on this once we have a solid results for IPsec install/upgrade. |
|
CentOS builds should be available now. |
pperiyasamy
changed the title
|
@pperiyasamy: This pull request references SDN-5330 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
/hold cancel The |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/assign @igsilya |
|
It looks like we must get this PR landed first because CI build with |
|
/retest |
|
The |
Signed-off-by: Periyasamy Palanisamy <[email protected]>
Currently the network operator brings up ovn-ipsec-host daemonset pod once the ipsec machine config plugin is installed on the node. The pod spins up ovs-monitor-ipsec script to create/update mesh of IPsec connections across the nodes. This makes ipsec connections to be established for the existing nodes a bit later after kubelet is started, but by the time workloads are scheduled on the node started hitting traffic drops because of unavailability of IPsec connections between nodes. This makes IPsec jobs in CI so unstable and monitor jobs always failing during IPsec upgrade. The FDP story (https://issues.redhat.com/browse/FDP-1051) gets openvswitch-ipsec systemd service (runs ovs-monitor-ipsec) with required configurable parameters for network operator. It's available with OVS 3.5 version, So OCP can use this service running on the host for configuring IPsec for east west traffic. Hence this commit includes openvswitch-ipsec package to be part of the ipsec extension, ovs-monitor-ipsec to be run as a systemd service on the node and ovn-ipsec-host pod would now only be used to configure the service. This provides more flexibility in managing IPsec connections created by OVN and OVS, helps to bring up existing IPsec connections timely before kubelet service comes up upon node reboot scenarios. Signed-off-by: Periyasamy Palanisamy <[email protected]>
pperiyasamy
force-pushed
the
add-openvswitch-ipsec
branch
from
2a27e82 to
61b76c1
Compare
|
@pperiyasamy: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retest |
1 similar comment
|
/retest |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: igsilya, jlebon, pperiyasamy The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
openshift-merge-bot
bot
merged commit e1cf9d5
into
openshift:master
Currently the network operator brings up ovn-ipsec-host daemonset pod once the ipsec machine config plugin is installed on the node. The pod spins up ovs-monitor-ipsec script to create/update mesh of IPsec connections across
the nodes. This makes ipsec connections to be established for the existing nodes a bit later after kubelet is started, but by the time workloads are scheduled on the node started hitting traffic drops because of unavailability of IPsec connections between nodes. This makes IPsec jobs in CI so unstable and monitor jobs always failing during IPsec upgrade.
The FDP story (https://issues.redhat.com/browse/FDP-1051) gets openvswitch-ipsec systemd service (runs ovs-monitor-ipsec) with required configurable parameters for network operator. It's available with OVS 3.5 version, So OCP can use this service running on the host for configuring IPsec for east west traffic.
This PR bumps OVS version to 3.5 and includes openvswitch-ipsec package to be part of the ipsec extension, It enables ovs-monitor-ipsec to be run as a systemd service on the node and ovn-ipsec-host pod would now only be used to configure the service. This provides more flexibility in managing IPsec connections created by OVN and OVS, helps to bring up existing IPsec connections timely before kubelet service comes up upon node reboot scenarios.