Add a CNO secondary encap CI lane #81614
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - core-networking-approvers | ||
| reviewers: | ||
| - core-networking-reviewers |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - core-networking-approvers | ||
| reviewers: | ||
| - core-networking-reviewers |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - core-networking-approvers | ||
| reviewers: | ||
| - core-networking-reviewers |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "path": "cluster-network-operator/ovn/secondary-encap/cluster-network-operator-ovn-secondary-encap-workflow.yaml", | ||
| "owners": { | ||
| "approvers": [ | ||
| "core-networking-approvers" | ||
| ], | ||
| "reviewers": [ | ||
| "core-networking-reviewers" | ||
| ] | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| workflow: | ||
| as: cluster-network-operator-ovn-secondary-encap | ||
| steps: | ||
| cluster_profile: equinix-ocp-metal | ||
| env: | ||
| DEVSCRIPTS_CONFIG: | | ||
| IP_STACK=v4 | ||
| NETWORK_TYPE=OVNKubernetes | ||
| EXTRA_MG_ARGS: --host-network | ||
| EXTRA_NETWORK_CONFIG: | | ||
| EXTRA_NETWORK_NAMES="extranet" | ||
| EXTRANET_NETWORK_SUBNET_V4='192.168.221.0/24' | ||
| pre: | ||
| - ref: baremetalds-devscripts-conf-extranetwork | ||
| - chain: baremetalds-ofcir-pre | ||
| - ref: baremetalds-e2e-ovn-debug-enable-console | ||
| - ref: cluster-network-operator-ovn-secondary-encap-pre | ||
| test: | ||
| - ref: cluster-network-operator-ovn-secondary-encap-validate | ||
| - chain: baremetalds-ipi-test | ||
| post: | ||
| - ref: baremetalds-e2e-ovn-debug-console-gather | ||
| - chain: baremetalds-ofcir-post | ||
| documentation: |- | ||
| This workflow provisions a baremetal OVN cluster with an additional extranet | ||
| network, injects openshift-ovn-kubernetes/env-overrides with per-node | ||
| OVN_ENCAP_IP values derived from the secondary interface, validates that | ||
| ovnkube-node uses the secondary interface address for encapsulation, and then | ||
| runs the standard baremetal end-to-end test suite. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - core-networking-approvers | ||
| reviewers: | ||
| - core-networking-reviewers |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -o nounset | ||
| set -o errexit | ||
| set -o pipefail | ||
|
|
||
| echo "************ cluster-network-operator ovn secondary encap pre ************" | ||
|
|
||
| namespace="openshift-ovn-kubernetes" | ||
| configmap_name="env-overrides" | ||
| mapping_file="${SHARED_DIR}/cno-secondary-encap-mapping.tsv" | ||
| artifacts_dir="${ARTIFACT_DIR:-${SHARED_DIR}}" | ||
| configmap_file="${artifacts_dir}/cno-secondary-encap-env-overrides.yaml" | ||
|
|
||
| subnet_line=$(printf '%s\n' "${EXTRA_NETWORK_CONFIG:-}" | awk -F= '/^EXTRANET_NETWORK_SUBNET_V4=/{print $2; exit}') | ||
| EXTRANET_NETWORK_SUBNET_V4="${subnet_line//\'/}" | ||
|
|
||
| if [[ -z "${EXTRANET_NETWORK_SUBNET_V4}" ]]; then | ||
| echo "EXTRA_NETWORK_CONFIG must include EXTRANET_NETWORK_SUBNET_V4, got: ${EXTRA_NETWORK_CONFIG:-<empty>}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! [[ "${EXTRANET_NETWORK_SUBNET_V4}" =~ ^([0-9]{1,3}\.){3}0/24$ ]]; then | ||
| echo "EXTRANET_NETWORK_SUBNET_V4 must be a valid /24 network address (x.x.x.0/24), got ${EXTRANET_NETWORK_SUBNET_V4}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| secondary_prefix="${EXTRANET_NETWORK_SUBNET_V4%.0/24}." | ||
| escaped_secondary_prefix=$(printf '%s' "${secondary_prefix}" | sed 's/\./\\./g') | ||
|
|
||
| # get_ovnkube_container returns the container name that provides the OVN | ||
| # tooling inside an ovnkube-node pod. | ||
| get_ovnkube_container() { | ||
| local pod_name="$1" | ||
| local containers | ||
|
|
||
| containers=$(oc get pod -n "${namespace}" "${pod_name}" -o jsonpath='{.spec.containers[*].name}') | ||
| for candidate in ovnkube-controller ovnkube-node; do | ||
| if [[ " ${containers} " == *" ${candidate} "* ]]; then | ||
| echo "${candidate}" | ||
| return 0 | ||
| fi | ||
| done | ||
|
|
||
| echo "unable to find a supported OVN container in pod ${pod_name}" >&2 | ||
| return 1 | ||
| } | ||
|
|
||
| # get_secondary_interface_record returns the "<interface>\t<address/cidr>" pair | ||
| # for the extra-network address that matches the configured secondary subnet. | ||
| get_secondary_interface_record() { | ||
| local pod_name="$1" | ||
| local container_name="$2" | ||
|
|
||
| oc exec -n "${namespace}" "${pod_name}" -c "${container_name}" -- bash -c \ | ||
| "ip -o -4 addr show scope global | awk '\$4 ~ /^${escaped_secondary_prefix}/ {print \$2 \"\t\" \$4; exit}'" | ||
| } | ||
|
|
||
| oc wait pod -n "${namespace}" -l app=ovnkube-node --for=condition=Ready --timeout=10m | ||
|
|
||
| readarray -t ovnkube_pods < <(oc get pods -n "${namespace}" -l app=ovnkube-node -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') | ||
| if [[ ${#ovnkube_pods[@]} -eq 0 ]]; then | ||
| echo "no ovnkube-node pods found in ${namespace}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| : > "${mapping_file}" | ||
|
|
||
| for pod_name in "${ovnkube_pods[@]}"; do | ||
| node_name=$(oc get pod -n "${namespace}" "${pod_name}" -o jsonpath='{.spec.nodeName}') | ||
| if ! container_name=$(get_ovnkube_container "${pod_name}"); then | ||
| echo "unable to determine OVN container for pod ${pod_name}" >&2 | ||
| exit 1 | ||
| fi | ||
| if ! secondary_record=$(get_secondary_interface_record "${pod_name}" "${container_name}"); then | ||
| echo "unable to read the secondary interface record from pod ${pod_name}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [[ -z "${secondary_record}" ]]; then | ||
| echo "unable to find a secondary interface in pod ${pod_name} for subnet ${EXTRANET_NETWORK_SUBNET_V4}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| secondary_iface=${secondary_record%%$'\t'*} | ||
| secondary_cidr=${secondary_record#*$'\t'} | ||
| secondary_ip=${secondary_cidr%%/*} | ||
|
|
||
| echo "Discovered secondary encap source for ${node_name}: ${secondary_iface} ${secondary_ip}" | ||
| printf '%s\t%s\t%s\t%s\n' "${node_name}" "${secondary_ip}" "${secondary_iface}" "${pod_name}" >> "${mapping_file}" | ||
| done | ||
|
|
||
| echo "Resolved per-node secondary interface mapping:" | ||
| while IFS=$'\t' read -r node_name secondary_ip secondary_iface pod_name; do | ||
| echo " node=${node_name} pod=${pod_name} interface=${secondary_iface} ip=${secondary_ip}" | ||
| done < "${mapping_file}" | ||
|
|
||
| { | ||
| cat <<EOF | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: ${configmap_name} | ||
| namespace: ${namespace} | ||
| data: | ||
| EOF | ||
|
|
||
| while IFS=$'\t' read -r node_name secondary_ip _secondary_iface _pod_name; do | ||
| cat <<EOF | ||
| ${node_name}: | | ||
| OVN_ENCAP_IP=${secondary_ip} | ||
| EOF | ||
| done < "${mapping_file}" | ||
| } > "${configmap_file}" | ||
|
|
||
| echo "Applying ${namespace}/${configmap_name}" | ||
| cat "${configmap_file}" | ||
| oc apply -f "${configmap_file}" | ||
| echo "Applied ${namespace}/${configmap_name}:" | ||
| oc get configmap -n "${namespace}" "${configmap_name}" -o yaml | ||
|
|
||
| echo "Restarting ovnkube-node to pick up the updated env-overrides ConfigMap" | ||
| oc rollout restart daemonset/ovnkube-node -n "${namespace}" | ||
| oc rollout status daemonset/ovnkube-node -n "${namespace}" --timeout=15m | ||
| oc wait pod -n "${namespace}" -l app=ovnkube-node --for=condition=Ready --timeout=10m | ||
|
|
||
| echo "Mounted env-overrides content observed from ovnkube-node pods:" | ||
| while IFS=$'\t' read -r node_name _secondary_ip _secondary_iface _pod_name; do | ||
| if ! pod_name=$(oc get pods -n "${namespace}" -l app=ovnkube-node --field-selector "spec.nodeName=${node_name}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null); then | ||
| pod_name="" | ||
| fi | ||
| if [[ -z "${pod_name}" ]]; then | ||
| echo " node=${node_name} pod=<missing> override_file=<unavailable>" | ||
| continue | ||
| fi | ||
|
|
||
| if ! container_name=$(get_ovnkube_container "${pod_name}"); then | ||
| echo " node=${node_name} pod=${pod_name} override_file=<container lookup failed>" | ||
| continue | ||
| fi | ||
| echo "----- ${node_name} (${pod_name}) /env/${node_name} -----" | ||
| oc exec -n "${namespace}" "${pod_name}" -c "${container_name}" -- bash -c \ | ||
| "if [[ -f \"/env/${node_name}\" ]]; then cat \"/env/${node_name}\"; else echo \"override file missing\"; fi" | ||
| done < "${mapping_file}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "path": "cluster-network-operator/ovn/secondary-encap/pre/cluster-network-operator-ovn-secondary-encap-pre-ref.yaml", | ||
| "owners": { | ||
| "approvers": [ | ||
| "core-networking-approvers" | ||
| ], | ||
| "reviewers": [ | ||
| "core-networking-reviewers" | ||
| ] | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| ref: | ||
| as: cluster-network-operator-ovn-secondary-encap-pre | ||
| from: cli | ||
| commands: cluster-network-operator-ovn-secondary-encap-pre-commands.sh | ||
| grace_period: 10m | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| memory: 100Mi | ||
| env: | ||
| - name: EXTRA_NETWORK_CONFIG | ||
| default: "" | ||
| documentation: |- | ||
| Additional dev-scripts network configuration. This step reads | ||
| EXTRANET_NETWORK_SUBNET_V4 from this value so the workflow's extra-network | ||
| provisioning config is the single source of truth for the subnet. | ||
| documentation: |- | ||
| Discover the secondary interface IPv4 address on each ovnkube-node pod from | ||
| the workflow's EXTRA_NETWORK_CONFIG, then apply | ||
| openshift-ovn-kubernetes/env-overrides with a node-specific OVN_ENCAP_IP | ||
| entry for encapsulation validation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| approvers: | ||
| - core-networking-approvers | ||
| reviewers: | ||
| - core-networking-reviewers |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: I don't think we have changes in ovnkube-node.yml in your PR but its fine, approving this