From 0ac1d1c821e050cc6fc91b84f03183190fcc4656 Mon Sep 17 00:00:00 2001 From: Periyasamy Palanisamy Date: Wed, 27 Aug 2025 15:18:20 +0200 Subject: [PATCH] Skip _stackmanager execution for libreswan 5.3+ The _stackmanager binary was removed in libreswan 5.3 and is no longer required for prerequisite checks. This commit conditionally runs _stackmanager only when the binary is present on the system. Signed-off-by: Periyasamy Palanisamy --- .../network/ovn-kubernetes/common/ipsec-containerized.yaml | 7 +++++-- bindata/network/ovn-kubernetes/common/ipsec-host.yaml | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/bindata/network/ovn-kubernetes/common/ipsec-containerized.yaml b/bindata/network/ovn-kubernetes/common/ipsec-containerized.yaml index fd730f64b6..34f195e076 100644 --- a/bindata/network/ovn-kubernetes/common/ipsec-containerized.yaml +++ b/bindata/network/ovn-kubernetes/common/ipsec-containerized.yaml @@ -269,8 +269,11 @@ spec: ulimit -n 1024 /usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig - # Check kernel modules - /usr/libexec/ipsec/_stackmanager start + # Check kernel modules only for libreswan version <= 5.2. The _stackmanager binary is + # removed from 5.3 onwards, so this check is not needed on later versions. + if [ -e /usr/libexec/ipsec/_stackmanager ]; then + /usr/libexec/ipsec/_stackmanager start + fi # Check nss database status /usr/sbin/ipsec --checknss # Start the pluto IKE daemon diff --git a/bindata/network/ovn-kubernetes/common/ipsec-host.yaml b/bindata/network/ovn-kubernetes/common/ipsec-host.yaml index e274f9ceb7..3a3e549c61 100644 --- a/bindata/network/ovn-kubernetes/common/ipsec-host.yaml +++ b/bindata/network/ovn-kubernetes/common/ipsec-host.yaml @@ -280,8 +280,11 @@ spec: ulimit -n 1024 /usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig - # Check kernel modules - /usr/libexec/ipsec/_stackmanager start + # Check kernel modules only for libreswan version <= 5.2. The _stackmanager binary is + # removed from 5.3 onwards, so this check is not needed on later versions. + if [ -e /usr/libexec/ipsec/_stackmanager ]; then + /usr/libexec/ipsec/_stackmanager start + fi # Check nss database status /usr/sbin/ipsec --checknss