[release-4.18] OCPBUGS-111878: backport of #2662 - #3125
Conversation
The consumption of openvswitch-ipsec systemd service from the host for the ovn-ipsec-host deployment helps to avoid using any host binaries to be running from ovn-ipsec container, so it solves protocol, glibc and hardware compatibility issues when RHEL10 is supported for OCP platforms. Hence this commit does the following: 1. Stop spawning ovs-monitor-ipsec as foreground process in the ovn-ipsec container. Instead setup required IPsec configuration parameters in the /etc/sysconfig/openvswitch file, enable and start the openvswitch-ipsec service on the host. This is done at the time when ovn-ipsec-host pod is coming up for the first time. For the pod restart scenarios, it just checks openvswitch-ipsec service is running on the host, otherwise exit from the container with error. 2. Keep running an ovn-ipsec container that waits for the ovs-monitor-ipsec.log file to be created, monitors the openvswitch-ipsec service health, and redirects /var/log/openvswitch/ovs-monitor-ipsec.log to the ovn-ipsec container's stdout console. The container fails if the systemd service stops unexpectedly, ensuring proper pod lifecycle management. 3. There is no necessity of doing ipsec state and policy cleanup in ovn-ipsec-cleanup container when OVN IPsec is handled via openvswitch-ipsec systemd service. 4. During the OCP upgrade, the new ipsec os extension takes a while to deploy with openvswitch3.5-ipsec package, so by the time ovn-ipsec-host daemonset is rendered, we need to handle that scenario by running ovs-monitor-ipsec in the container. So this commit is also considering the transition phase of the process that is moving from container to host. 5. The ovn-keys init container configures ovs with IPsec certificate paths, so the container uses same host directory path to store and configure ovs with certificates because the ovs-monitor-ipsec process is running on the host now. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
This commit removes the mount of /usr/sbin from the host to eliminate need for host binaries. it would make chroot to use container binary which avoids GLIBC compatibility issue. The 'ipsec --checknss' check is removed, it doesn't run during upgrade until openvswitch3.5-ipsec is deployed to the node anyway, so it's safe to skip during that transition period. The liveness probe now uses 'ovs-appctl -t ovs-monitor-ipsec ipsec/status' instead of 'ipsec whack --trafficstatus' to check for configured IPsec tunnels without requiring host binaries. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
During OCP upgrade the new ovn-ipsec-host pod is rendered before the machine config rolls out openvswitch3.5-ipsec package to node. This causes the container to fall back to running ovs-monitor-ipsec in the container, but mounting host's /usr/libexec shadows container binaries and causes GLIBC compatibility errors (GLIBC_ABI_DT_RELR not found) when executing binaries like addconn and platform-python. - Remove /usr/libexec host mount entirely as it's no longer needed. - Use container's /usr/libexec/platform-python binary to run ovs-monitor-ipsec script. - Remove addconn validation as /etc/ipsec.conf is managed by ovs-monitor-ipsec and wait-for-ipsec-connect service, so it is always syntactically correct. - Remove _stackmanager check as it's obsolete (removed in libreswan 5.3+) and OCP must be using this version since 4.19. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: LionelJouin The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@LionelJouin: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/jira refresh |
|
@LionelJouin: No Jira issue is referenced in the title of this pull request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
LionelJouin
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@LionelJouin: This pull request references Jira Issue OCPBUGS-53316, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
|
/jira refresh |
|
@LionelJouin: This pull request references Jira Issue OCPBUGS-53316, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
LionelJouin
changed the title
openshift-ci-robot
added
the
jira/valid-bug
|
/jira refresh |
|
@LionelJouin: This pull request references Jira Issue OCPBUGS-111878, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (core-networking-bot@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
jira/invalid-bug
|
@LionelJouin: This pull request references Jira Issue OCPBUGS-111878, which is valid. 7 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (core-networking-bot@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3 participants
Backport of #2662 to release-4.18.
Fixes ovn-ipsec-host on RHEL worker nodes as there is a shared library mismatch with RHEL 8. Since #2576, the host binaries are used instead of the container binaries, #2662 fixed it.
This will also be backported to 4.17, 4.16, 4.15.
4.19+ is not impacted as RHEL worker node is no longer supported.
RHEL worker nodes with RHEL 9+ is not impacted as shared library are existing.
/usr/libexec/ipsec/addconn: error while loading shared libraries: libunbound.so.2: cannot open shared object file: No such file or directory