USHIFT-7501: Stop openvswitch after OVN cleanup in microshift-cleanup-data by agullon · Pull Request #7347 · openshift/microshift

agullon · 2026-09-08T21:30:16Z

Summary

After microshift-cleanup-data --all (or --ovn) stops ovsdb-server and kills the OVN processes, ovs-vswitchd is left running without its database, leaving stale OVS datapath/flow state. On the next MicroShift start, ovnkube-node fatals during init while clearing stale OVS flow targets:

failed to init default node network controller: error clearing stale ovs flow targets: "exit status 1"

ovnkube-node then crash-loops, never writes the node chassis / gateway config, and every pod is stuck FailedCreatePodSandBox / NetworkPluginNotReady until the healthcheck times out.

Fix

Stop openvswitch.service after the OVN process cleanup in clean_processes(), so the stale OVS state is cleared. The next MicroShift start brings openvswitch back up via microshift.service's Wants= and microshift-ovs-init.service's Requires=, giving OVN a clean slate to reinitialize. Unlike the best-effort kills above, a real stop failure here has a correctness impact, so it is surfaced (WARN to stderr) rather than discarded.

The underlying fragility — ovnkube-node treating the ovs-vsctl failure as fatal — is upstream ovn-kubernetes; this change removes the precondition on the MicroShift side.

Where observed

Intermittently under heavy full-optional load, e.g. the el98-lrel@optional release scenario (MicroShift 5.0.0-rc.0 testing). Also implicated in the intermittent standard1 Hostname Verify MicroShift restarts correctly flake, which exercises the same clean-data + restart + healthcheck path.

Testing

Not unit-testable in isolation — reproduction requires a running cluster where microshift-cleanup-data --all + restart is followed by OVN reinit under load. Mechanism confirmed from ovnkube-node logs and the OVS service dependency graph. Will validate via CI e2e once the PR runs.

Jira

https://issues.redhat.com/browse/USHIFT-7501

Summary by CodeRabbit

Bug Fixes
- Cleanup now stops the Open vSwitch service after terminating OVN-related processes.
- A warning appears if the service cannot be stopped, indicating that stale flow state may remain.
- Cleanup results now provide clearer visibility into any residual networking state requiring follow-up.

openshift-merge-bot · 2026-09-08T21:30:19Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-08T21:30:20Z

@agullon: This pull request references USHIFT-7501 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

After microshift-cleanup-data --all (or --ovn) stops ovsdb-server and kills the OVN processes, ovs-vswitchd is left running without its database, leaving stale OVS datapath/flow state. On the next MicroShift start, ovnkube-node fatals during init while clearing stale OVS flow targets:
failed to init default node network controller: error clearing stale ovs flow targets: "exit status 1"
ovnkube-node then crash-loops, never writes the node chassis / gateway config, and every pod is stuck FailedCreatePodSandBox / NetworkPluginNotReady until the healthcheck times out.

Fix

Stop openvswitch.service after the OVN process cleanup in clean_processes(), so the stale OVS state is cleared. The next MicroShift start brings openvswitch back up via microshift.service's Wants= and microshift-ovs-init.service's Requires=, giving OVN a clean slate to reinitialize. Unlike the best-effort kills above, a real stop failure here has a correctness impact, so it is surfaced (WARN to stderr) rather than discarded.

The underlying fragility — ovnkube-node treating the ovs-vsctl failure as fatal — is upstream ovn-kubernetes; this change removes the precondition on the MicroShift side.

Where observed

Intermittently under heavy full-optional load, e.g. the el98-lrel@optional release scenario (MicroShift 5.0.0-rc.0 testing). Also implicated in the intermittent standard1 Hostname Verify MicroShift restarts correctly flake, which exercises the same clean-data + restart + healthcheck path.

Testing

Not unit-testable in isolation — reproduction requires a running cluster where microshift-cleanup-data --all + restart is followed by OVN reinit under load. Mechanism confirmed from ovnkube-node logs and the OVS service dependency graph. Will validate via CI e2e once the PR runs.

Jira

https://issues.redhat.com/browse/USHIFT-7501

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-08T21:30:36Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: agullon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [agullon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-09-08T21:30:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6945fc34-6ba6-4fbb-baf9-48e9cb7aae7a

📥 Commits

Reviewing files that changed from the base of the PR and between 4b58d80 and 167cf38.

📒 Files selected for processing (1)

scripts/microshift-cleanup-data.sh

🚧 Files skipped from review as they are similar to previous changes (1)

scripts/microshift-cleanup-data.sh

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

Walkthrough

The cleanup script stops openvswitch.service after terminating OVN-related processes. Stop failures produce a warning, and cleanup continues.

Changes

Open vSwitch cleanup

Layer / File(s)	Summary
Stop Open vSwitch during cleanup `scripts/microshift-cleanup-data.sh`	The script stops `openvswitch.service` after terminating related processes. It warns when the stop fails and continues cleanup.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 167cf

Cleanup now stops Open vSwitch after OVN cleanup to remove stale datapath state. No concrete unresolved production-impact risk is identified for this change.

Suggested labels: ready-for-human-review

Suggested reviewers: ggiguash

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: stopping openvswitch.service after OVN cleanup in microshift-cleanup-data.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh`. The exact diff adds `systemctl stop openvswitch.service` and a warning. It adds no Ginkgo test declarations or test titles, an…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh` (+4 lines) and adds no Ginkgo test code or test blocks. The Ginkgo-specific requirements are therefore not applicable. Existing…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh` (+4 lines). The diff adds a `systemctl stop openvswitch.service` call and warning; it adds no Ginkgo e2e tests or test declarat…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh` and adds four shell-script lines. The exact diff contains no new Ginkgo tests (`It()`, `Describe()`, `Context()`, or `When()`),…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh`. The diff adds a `systemctl stop openvswitch.service` call and a warning. It does not add or modify deployment manifests, opera…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh`; it does not modify an OTE binary or Go process-level setup. The added warning explicitly writes to stderr. The existing shell-…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only `scripts/microshift-cleanup-data.sh` by adding an `openvswitch.service` stop and warning. It adds no Ginkgo e2e tests and introduces no IPv4 assumptions or external…
No-Weak-Crypto	✅ Passed	PASS. The pull request adds only an `openvswitch.service` stop and a warning in `scripts/microshift-cleanup-data.sh`. The exact patch contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypt…
Container-Privileges	✅ Passed	PASS. The pull request changes only `scripts/microshift-cleanup-data.sh`. The added lines call `systemctl stop openvswitch.service` and emit a warning; they do not add container or Kubernetes privileg…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds only a fixed warning: `failed to stop openvswitch.service; stale OVS flow state may persist`. It contains no password, token, API key, PII, session ID, hostname, or custome…

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

agullon · 2026-09-08T21:37:45Z

/pipeline required

openshift-merge-bot · 2026-09-08T21:37:49Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-tests
/test e2e-aws-tests-arm
/test e2e-aws-tests-bootc-arm-el10
/test e2e-aws-tests-bootc-arm-el9
/test e2e-aws-tests-bootc-el10
/test e2e-aws-tests-bootc-el9

agullon · 2026-09-09T05:49:45Z

/retest

agullon · 2026-09-09T07:28:05Z

/cherrypick release-5.0

openshift-cherrypick-robot · 2026-09-09T07:28:09Z

@agullon: once the present PR merges, I will cherry-pick it on top of release-5.0 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-5.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

agullon · 2026-09-09T08:15:10Z

/override ci/prow/e2e-aws-tests-bootc-el9
/override ci/prow/e2e-aws-tests-bootc-el10

because only 2 scenarios failed and failures are not related to this change

agullon · 2026-09-09T08:15:30Z

/verified by CI

openshift-ci · 2026-09-09T08:15:34Z

@agullon: Overrode contexts on behalf of agullon: ci/prow/e2e-aws-tests-bootc-el10, ci/prow/e2e-aws-tests-bootc-el9

Details

In response to this:

/override ci/prow/e2e-aws-tests-bootc-el9
/override ci/prow/e2e-aws-tests-bootc-el10

because only 2 scenarios failed and failures are not related to this change

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-09-09T08:15:42Z

@agullon: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-09T14:01:25Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

openshift-ci-robot · 2026-09-09T14:02:10Z

@agullon: This pull request references USHIFT-7501 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

After microshift-cleanup-data --all (or --ovn) stops ovsdb-server and kills the OVN processes, ovs-vswitchd is left running without its database, leaving stale OVS datapath/flow state. On the next MicroShift start, ovnkube-node fatals during init while clearing stale OVS flow targets:
failed to init default node network controller: error clearing stale ovs flow targets: "exit status 1"
ovnkube-node then crash-loops, never writes the node chassis / gateway config, and every pod is stuck FailedCreatePodSandBox / NetworkPluginNotReady until the healthcheck times out.

Fix

Stop openvswitch.service after the OVN process cleanup in clean_processes(), so the stale OVS state is cleared. The next MicroShift start brings openvswitch back up via microshift.service's Wants= and microshift-ovs-init.service's Requires=, giving OVN a clean slate to reinitialize. Unlike the best-effort kills above, a real stop failure here has a correctness impact, so it is surfaced (WARN to stderr) rather than discarded.

The underlying fragility — ovnkube-node treating the ovs-vsctl failure as fatal — is upstream ovn-kubernetes; this change removes the precondition on the MicroShift side.

Where observed

Intermittently under heavy full-optional load, e.g. the el98-lrel@optional release scenario (MicroShift 5.0.0-rc.0 testing). Also implicated in the intermittent standard1 Hostname Verify MicroShift restarts correctly flake, which exercises the same clean-data + restart + healthcheck path.

Testing

Not unit-testable in isolation — reproduction requires a running cluster where microshift-cleanup-data --all + restart is followed by OVN reinit under load. Mechanism confirmed from ovnkube-node logs and the OVS service dependency graph. Will validate via CI e2e once the PR runs.

Jira

https://issues.redhat.com/browse/USHIFT-7501

Summary by CodeRabbit

Bug Fixes

Cleanup now stops the Open vSwitch service after terminating OVN-related processes.

A warning is shown if the service cannot be stopped, indicating that stale flow state may remain.

This improves cleanup reliability and makes potential residual networking state visible for follow-up.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…-data After `microshift-cleanup-data --all` (or `--ovn`) stops ovsdb-server and kills the OVN processes, ovs-vswitchd is left running without its database, so stale OVS datapath/flow state persists. On the next MicroShift start ovnkube-node fatals during init while clearing stale OVS flow targets: failed to init default node network controller: error clearing stale ovs flow targets: "exit status 1" ovnkube-node then crash-loops, never writes the node chassis / gateway config, and every pod is stuck FailedCreatePodSandBox / NetworkPluginNotReady until the healthcheck times out. This was observed intermittently under heavy full-optional load (e.g. the el98-lrel@optional release scenario). Stop openvswitch.service after the OVN process cleanup so the stale state is cleared. The next MicroShift start brings openvswitch back up via microshift.service's Wants and microshift-ovs-init.service's Requires, giving OVN a clean slate to reinitialize. Unlike the best-effort kills above, a real stop failure here has a correctness impact, so it is surfaced rather than discarded. The underlying fragility (ovnkube-node treating the ovs-vsctl failure as fatal) is upstream ovn-kubernetes; this change removes the precondition on the MicroShift side. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED

coderabbitai · 2026-09-09T14:03:23Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

agullon · 2026-09-09T14:04:27Z

/pipeline required

openshift-merge-bot · 2026-09-09T14:04:30Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-tests
/test e2e-aws-tests-arm
/test e2e-aws-tests-bootc-arm-el10
/test e2e-aws-tests-bootc-arm-el9
/test e2e-aws-tests-bootc-el10
/test e2e-aws-tests-bootc-el9

agullon · 2026-09-09T14:07:18Z

/pipeline auto

openshift-merge-bot · 2026-09-09T14:07:22Z

Pipeline controller notification

The pipeline-auto label has been added to this PR. Second-stage tests will be triggered automatically when all first-stage tests pass.

agullon · 2026-09-09T14:07:43Z

/verified by CI

agullon · 2026-09-09T14:07:50Z

/cherrypick release-5.0

openshift-cherrypick-robot · 2026-09-09T14:07:54Z

@agullon: once the present PR merges, I will cherry-pick it on top of release-5.0 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-5.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-09-09T14:08:00Z

@agullon: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 8, 2026

openshift-ci Bot requested review from eslutsky and pacevedom September 8, 2026 21:30

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 8, 2026

coderabbitai Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Sep 8, 2026

coderabbitai Bot approved these changes Sep 8, 2026

View reviewed changes

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 9, 2026

agullon mentioned this pull request Sep 9, 2026

[release-5.0] NO-ISSUE: Test and script fixes found during 5.0.0-rc.0 testing #7327

Merged

ggiguash reviewed Sep 9, 2026

View reviewed changes

Comment thread scripts/microshift-cleanup-data.sh Outdated

agullon force-pushed the USHIFT-7501 branch from 80243af to 9d498e0 Compare September 9, 2026 14:01

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Sep 9, 2026

coderabbitai Bot removed the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Sep 9, 2026

agullon force-pushed the USHIFT-7501 branch from 9d498e0 to 167cf38 Compare September 9, 2026 14:02

coderabbitai Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Sep 9, 2026

openshift-merge-bot Bot added the pipeline-auto label Sep 9, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 9, 2026

agullon marked this pull request as draft September 9, 2026 14:57

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 9, 2026

Uh oh!

Conversation

agullon commented Sep 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Where observed

Testing

Jira

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Sep 8, 2026

Uh oh!

openshift-ci-robot commented Sep 8, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Where observed

Testing

Jira

Uh oh!

openshift-ci Bot commented Sep 8, 2026

Uh oh!

coderabbitai Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

agullon commented Sep 8, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 8, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

openshift-cherrypick-robot commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

openshift-ci Bot commented Sep 9, 2026

Uh oh!

openshift-ci-robot commented Sep 9, 2026

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 9, 2026

Uh oh!

openshift-ci-robot commented Sep 9, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Where observed

Testing

Jira

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

agullon commented Sep 9, 2026

Uh oh!

openshift-cherrypick-robot commented Sep 9, 2026

Uh oh!

openshift-ci-robot commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

agullon commented Sep 8, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Sep 8, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Sep 8, 2026 •

edited

Loading

openshift-ci-robot commented Sep 9, 2026 •

edited by openshift-ci Bot

Loading