[release-4.18] OCPBUGS-50582: Graceful cleanup of IPsec states #2644
Conversation
There is an incorrect check while cleaning up ipsec state upon deleting ipsec pod which removes states in all cases, so this fix removes state only when ipsec mode is not full mode. Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit 864bdc5)
This reverts commit e0bfa7e. Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit ece9fbb)
Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit ea1d489)
The following change on the machine pool `status.MachineCount == status.UpdatedMachineCount && hasSourceInMachineConfigStatus(status, machineConfigs)` is introduced with PR openshift#2349 which ensures IPsec machine config is always installed on all the nodes in the cluster, So this is deleting the IPsec daemonset as per the CNO state machine for IPsec when the condition is not met. But this is also accidentally disabling IPsec in OVN which is not an expected behavior. This causes ovs-monitor-ipsec to refresh existing ipsec connections unnecessarily when IPsec pod comes up as it is not able to find remote_name from the tunnel. This may also trigger deleting IPsec connection entries from openshift.conf file if ovs-monitor-ipsec is not killed timely when ipsec daemonset is removed. So this commit enables ovn ipsec option as long as the API is set with Full mode. Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit 4e57dcd)
This removes stale 4.13 IPsec upgrade handling code which is not a valid anymore for >=4.15 upgrade scenarios. Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit 3c99d4f)
The commit 4e57dcd is not complete because OVNIPsecStatus is still not set when none of the IPsec daemonset exists on the cluster at the time of machine config pools are updating (or) node is rebooted. Hence fixing it by OVNIPsecStatus is always set to reflect ipsec deployment state of the cluster and update the render pipeline to render ovn ipsec for the above mentioned scenarios. It renders ovn ipsec even before ipsec daemonsets are deployed when IPsec is freshly enabled on the cluster. That's ok because It will be effective only when the ovs-monitor-ipsec script is started and that's going to be done only when the ipsec pod is running. so we are safe to ignore it now. When IPsec is disabled from API, ovn ipsec is disabled followed by stop rendering ipsec machine config and ipsec daemonset. While ipsec machine configs are removed which would make ovnkube-node daemonset into progressing state and OVNIPsecActive condition becomes true again. Hence this commit considers machine config status as well so that the rendering pipeline will not render IPsec machine configs again. Signed-off-by: Periyasamy Palanisamy <[email protected]> (cherry picked from commit ff0b147)
openshift-ci-robot
added
jira/valid-reference
|
@pperiyasamy: This pull request references Jira Issue OCPBUGS-50582, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: pperiyasamy The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@pperiyasamy: This pull request references Jira Issue OCPBUGS-50582, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/assign @jcaamano @huiran0826 |
|
@pperiyasamy: This pull request references Jira Issue OCPBUGS-50582, which is valid. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@pperiyasamy: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR does the backport of following fixes to prevent unnecessary ipsec service restart, ip xfrm state policy cleanups while bringing up ipsec-host pod. This would potentially avoid reestablishment of IKE SAs during ipsec pod restarts and let OVN networking pods traffic go on without any packet drops.
/etc/ipsec.d/openshift.conffile, ip xfrm state and policy entries in all cases, but these must be removed only when ipsec mode is changed from full to external or disabled.TS_UNACCEPTABLEerror is seen temporarily at the time of ipsec service restart.Manually cherry picked master commits 864bdc5, ece9fbb, ea1d489, 4e57dcd and ff0b147, no conflicts seen.