search

ovn-org / ovn-kubernetes

A robust Kubernetes networking platform
https://ovn-kubernetes.io/
Apache License 2.0
767 stars 333 forks source link

e2e: Fix secondaryIPV6Subnet mask #4450

Closed kyrtapz closed 1 week ago

kyrtapz commented 1 week ago

The previous mask was invalid and docker was failing with: invalid subnet 2001:db8:abcd:1234:c000::/64: it should be 2001:db8:abcd:1234::/64

/cc @tssurya

tssurya commented 1 week ago

fix works:

2024-06-17T19:39:10.4656414Z Services of type NodePort should work on secondary node interfaces for ETP=local and ETP=cluster when backend pods are also served by EgressIP
2024-06-17T19:39:10.4658921Z /home/runner/work/ovn-kubernetes/ovn-kubernetes/test/e2e/service.go:894
2024-06-17T19:39:10.4660416Z   STEP: Creating a kubernetes client @ 06/17/24 19:39:10.464
2024-06-17T19:39:10.4661521Z   Jun 17 19:39:10.464: INFO: >>> kubeConfig: /home/runner/ovn.conf
2024-06-17T19:39:10.4663163Z   STEP: Building a namespace api object, basename services @ 06/17/24 19:39:10.464
2024-06-17T19:39:10.4749290Z   Jun 17 19:39:10.474: INFO: Skipping waiting for service account
2024-06-17T19:39:10.4845239Z   STEP: Creating the endpoints pod, one for each worker @ 06/17/24 19:39:10.484
2024-06-17T19:39:10.4897719Z   W0617 19:39:10.488954   63766 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "ovn-control-plane-ep-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "ovn-control-plane-ep-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "ovn-control-plane-ep-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "ovn-control-plane-ep-container" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
2024-06-17T19:39:12.5038026Z   W0617 19:39:12.502810   63766 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "ovn-worker-ep-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "ovn-worker-ep-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "ovn-worker-ep-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "ovn-worker-ep-container" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
2024-06-17T19:39:14.5158482Z   W0617 19:39:14.514874   63766 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "ovn-worker2-ep-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "ovn-worker2-ep-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "ovn-worker2-ep-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "ovn-worker2-ep-container" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
2024-06-17T19:39:16.5243990Z   STEP: Choosing egressIP pod @ 06/17/24 19:39:16.524
2024-06-17T19:39:16.5245342Z   Jun 17 19:39:16.524: INFO: EgressIP pod is services-7471/ovn-control-plane-ep
2024-06-17T19:39:16.5246933Z   STEP: Label egress node create external container to send egress traffic to via secondary MultiNIC EIP @ 06/17/24 19:39:16.524
2024-06-17T19:39:20.2004517Z   STEP: Create an EgressIP object with one secondary multi NIC egress IP defined @ 06/17/24 19:39:20.199
2024-06-17T19:39:20.2006039Z   Jun 17 19:39:20.200: INFO: Create the EgressIP configuration
2024-06-17T19:39:20.2008158Z   Jun 17 19:39:20.200: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:36237 --kubeconfig=/home/runner/ovn.conf --namespace=default create -f egressip.yaml'
2024-06-17T19:39:20.2712367Z   Jun 17 19:39:20.265: INFO: stderr: ""
2024-06-17T19:39:20.2724030Z   Jun 17 19:39:20.265: INFO: stdout: "egressip.k8s.ovn.org/egressip created\n"
2024-06-17T19:39:20.2726289Z   STEP: Check that the status is of length one and that it is assigned to ovn-control-plane @ 06/17/24 19:39:20.265
2024-06-17T19:39:20.2730579Z   Jun 17 19:39:20.265: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:36237 --kubeconfig=/home/runner/ovn.conf --namespace=default get eip -o json'
2024-06-17T19:39:20.3338854Z   Jun 17 19:39:20.333: INFO: stderr: ""
2024-06-17T19:39:20.3349405Z   Jun 17 19:39:20.333: INFO: stdout: "{\n    \"apiVersion\": \"v1\",\n    \"items\": [\n        {\n            \"apiVersion\": \"k8s.ovn.org/v1\",\n            \"kind\": \"EgressIP\",\n            \"metadata\": {\n                \"creationTimestamp\": \"2024-06-17T19:39:20Z\",\n                \"generation\": 2,\n                \"name\": \"egressip\",\n                \"resourceVersion\": \"3805\",\n                \"uid\": \"d0220b84-0760-4970-ac2c-64b4e5b826d1\"\n            },\n            \"spec\": {\n                \"egressIPs\": [\n                    \"10.10.10.105\"\n                ],\n                \"namespaceSelector\": {\n                    \"matchLabels\": {\n                        \"kubernetes.io/metadata.name\": \"services-7471\"\n                    }\n                }\n            },\n            \"status\": {\n                \"items\": [\n                    {\n                        \"egressIP\": \"10.10.10.105\",\n                        \"node\": \"ovn-control-plane\"\n                    }\n                ]\n            }\n        }\n    ],\n    \"kind\": \"List\",\n    \"metadata\": {\n        \"resourceVersion\": \"\"\n    }\n}\n"
2024-06-17T19:39:20.3356383Z   STEP: Creating an external container to send the ingress nodeport service traffic from @ 06/17/24 19:39:20.333
2024-06-17T19:39:20.7034146Z   STEP: Selecting additional IP addresses for each node @ 06/17/24 19:39:20.703
2024-06-17T19:39:20.7035557Z   STEP: Adding additional IP addresses to each node @ 06/17/24 19:39:20.703
2024-06-17T19:39:20.9107750Z   STEP: Creating NodePort services @ 06/17/24 19:39:20.91
2024-06-17T19:39:21.0873564Z   STEP: Waiting for the endpoints to pop up @ 06/17/24 19:39:21.087
2024-06-17T19:39:22.0875831Z   Jun 17 19:39:22.087: INFO: Waiting for amount of service:etp-local-svc endpoints to be 3
2024-06-17T19:39:23.0917471Z   Jun 17 19:39:23.091: INFO: Waiting for amount of service:etp-cluster-svc endpoints to be 3
2024-06-17T19:39:23.0956266Z   STEP: Checking connectivity to the external container from egressIP pod ovn-control-plane-ep and verify that the source IP is the secondary NIC egress IP @ 06/17/24 19:39:23.095
2024-06-17T19:39:23.0957683Z   Jun 17 19:39:23.095: INFO: Destination IPs for external container are ip=10.10.10.3
2024-06-17T19:39:23.0959558Z   Jun 17 19:39:23.095: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:36237 --kubeconfig=/home/runner/ovn.conf --namespace=services-7471 exec ovn-control-plane-ep -- curl --connect-timeout 2 10.10.10.3:80'
2024-06-17T19:39:23.2002218Z   Jun 17 19:39:23.199: INFO: stderr: "  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n\r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0\r100    45  100    45    0     0  22500      0 --:--:-- --:--:-- --:--:-- 22500\n"
2024-06-17T19:39:23.2004641Z   Jun 17 19:39:23.199: INFO: stdout: "<html><body><h1>It works!</h1></body></html>\n"
2024-06-17T19:39:23.2171745Z   STEP: Hitting service etp-local-svc on 172.18.0.2 via http @ 06/17/24 19:39:23.216
2024-06-17T19:39:23.2920264Z   STEP: Hitting service etp-local-svc on 172.18.0.3 via http @ 06/17/24 19:39:23.291
2024-06-17T19:39:23.3633013Z   STEP: Hitting service etp-local-svc on 172.18.0.4 via http @ 06/17/24 19:39:23.362
2024-06-17T19:39:23.4303588Z   STEP: Hitting service etp-local-svc on 172.18.1.1 via http @ 06/17/24 19:39:23.43
2024-06-17T19:39:23.5042660Z   STEP: Hitting service etp-local-svc on 172.18.1.2 via http @ 06/17/24 19:39:23.503
2024-06-17T19:39:23.5658722Z   STEP: Hitting service etp-local-svc on 172.18.1.3 via http @ 06/17/24 19:39:23.565
2024-06-17T19:39:23.6409246Z   Jun 17 19:39:23.640: INFO: NodeIP of node ovn-control-plane is 172.18.0.2
2024-06-17T19:39:23.6410913Z   STEP: Hitting service nodeport etp-local-svc on 172.18.0.2 via http @ 06/17/24 19:39:23.64
2024-06-17T19:39:23.6412279Z   Jun 17 19:39:23.640: INFO: map[172.18.0.6:{} fc00:f853:ccd:e793::6:{}]
2024-06-17T19:39:23.7136487Z   Jun 17 19:39:23.713: INFO: Received srcIP: 172.18.0.6:44608
2024-06-17T19:39:23.7138889Z   STEP: Hitting service etp-local-svc on 172.18.0.2 via udp @ 06/17/24 19:39:23.713
2024-06-17T19:39:23.7901438Z   STEP: Hitting service etp-local-svc on 172.18.0.3 via udp @ 06/17/24 19:39:23.789
2024-06-17T19:39:23.8665737Z   STEP: Hitting service etp-local-svc on 172.18.0.4 via udp @ 06/17/24 19:39:23.866
2024-06-17T19:39:23.9359647Z   STEP: Hitting service etp-local-svc on 172.18.1.1 via udp @ 06/17/24 19:39:23.935
2024-06-17T19:39:24.0073690Z   STEP: Hitting service etp-local-svc on 172.18.1.2 via udp @ 06/17/24 19:39:24.006
2024-06-17T19:39:24.0779921Z   STEP: Hitting service etp-local-svc on 172.18.1.3 via udp @ 06/17/24 19:39:24.077
2024-06-17T19:39:24.1503667Z   Jun 17 19:39:24.150: INFO: NodeIP of node ovn-control-plane is 172.18.0.2
2024-06-17T19:39:24.1504975Z   STEP: Hitting service nodeport etp-local-svc on 172.18.0.2 via udp @ 06/17/24 19:39:24.15
2024-06-17T19:39:24.1506695Z   Jun 17 19:39:24.150: INFO: map[172.18.0.6:{} fc00:f853:ccd:e793::6:{}]
2024-06-17T19:39:24.2160127Z   Jun 17 19:39:24.215: INFO: Received srcIP: 172.18.0.6:38090
2024-06-17T19:39:24.2161824Z   STEP: Hitting service etp-cluster-svc on 172.18.0.2 via http @ 06/17/24 19:39:24.215
2024-06-17T19:39:24.2865348Z   STEP: Hitting service etp-cluster-svc on 172.18.0.3 via http @ 06/17/24 19:39:24.286
2024-06-17T19:39:24.3681904Z   STEP: Hitting service etp-cluster-svc on 172.18.0.4 via http @ 06/17/24 19:39:24.367
2024-06-17T19:39:24.4392167Z   STEP: Hitting service etp-cluster-svc on 172.18.1.1 via http @ 06/17/24 19:39:24.438
2024-06-17T19:39:24.5155319Z   STEP: Hitting service etp-cluster-svc on 172.18.1.2 via http @ 06/17/24 19:39:24.515
2024-06-17T19:39:24.5867510Z   STEP: Hitting service etp-cluster-svc on 172.18.1.3 via http @ 06/17/24 19:39:24.586
2024-06-17T19:39:24.6691850Z   Jun 17 19:39:24.668: INFO: NodeIP of node ovn-control-plane is 172.18.0.2
2024-06-17T19:39:24.6693507Z   STEP: Hitting service nodeport etp-cluster-svc on 172.18.0.2 via http @ 06/17/24 19:39:24.668
2024-06-17T19:39:24.6694779Z   Jun 17 19:39:24.668: INFO: Mode is shared gateway OR service is ETP=cluster, so skipping srcIP verification
2024-06-17T19:39:24.6696634Z   STEP: Hitting service etp-cluster-svc on 172.18.0.2 via udp @ 06/17/24 19:39:24.668
2024-06-17T19:39:24.7441210Z   STEP: Hitting service etp-cluster-svc on 172.18.0.3 via udp @ 06/17/24 19:39:24.743
2024-06-17T19:39:24.8144401Z   STEP: Hitting service etp-cluster-svc on 172.18.0.4 via udp @ 06/17/24 19:39:24.814
2024-06-17T19:39:24.8860388Z   STEP: Hitting service etp-cluster-svc on 172.18.1.1 via udp @ 06/17/24 19:39:24.885
2024-06-17T19:39:24.9484854Z   STEP: Hitting service etp-cluster-svc on 172.18.1.2 via udp @ 06/17/24 19:39:24.948
2024-06-17T19:39:25.0167336Z   STEP: Hitting service etp-cluster-svc on 172.18.1.3 via udp @ 06/17/24 19:39:25.016
2024-06-17T19:39:25.0963214Z   Jun 17 19:39:25.096: INFO: NodeIP of node ovn-control-plane is 172.18.0.2
2024-06-17T19:39:25.0964728Z   STEP: Hitting service nodeport etp-cluster-svc on 172.18.0.2 via udp @ 06/17/24 19:39:25.096
2024-06-17T19:39:25.0966443Z   Jun 17 19:39:25.096: INFO: Mode is shared gateway OR service is ETP=cluster, so skipping srcIP verification
2024-06-17T19:39:25.0968351Z   STEP: Cleaning up external container @ 06/17/24 19:39:25.096
2024-06-17T19:39:25.5405653Z   STEP: Deleting additional IP addresses from nodes @ 06/17/24 19:39:25.54
2024-06-17T19:39:25.7917281Z   STEP: Deleting EgressIP Setup if any @ 06/17/24 19:39:25.791
2024-06-17T19:39:25.7923176Z   Jun 17 19:39:25.791: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:36237 --kubeconfig=/home/runner/ovn.conf --namespace=default delete eip egressip --ignore-not-found=true'
2024-06-17T19:39:25.8898276Z   Jun 17 19:39:25.889: INFO: stderr: "Warning: deleting cluster-scoped resources, not scoped to the provided namespace\n"
2024-06-17T19:39:25.8900351Z   Jun 17 19:39:25.889: INFO: stdout: "egressip.k8s.ovn.org \"egressip\" deleted\n"
2024-06-17T19:39:25.8903332Z   Jun 17 19:39:25.889: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:36237 --kubeconfig=/home/runner/ovn.conf --namespace=default label node ovn-control-plane k8s.ovn.org/egress-assignable-'
2024-06-17T19:39:25.9706402Z   Jun 17 19:39:25.970: INFO: stderr: ""
2024-06-17T19:39:25.9707695Z   Jun 17 19:39:25.970: INFO: stdout: "node/ovn-control-plane unlabeled\n"
2024-06-17T19:39:26.4012681Z   Jun 17 19:39:26.400: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:36237 --kubeconfig=/home/runner/ovn.conf --namespace=ovn-kubernetes exec ovnkube-node-kjq8q -- /bin/sh -x -c ip addr del 192.0.2.202/32 dev lo || true'
2024-06-17T19:39:26.5136508Z   Jun 17 19:39:26.513: INFO: stderr: "Defaulted container \"nb-ovsdb\" out of: nb-ovsdb, sb-ovsdb, ovn-northd, ovnkube-controller, ovn-controller, ovs-metrics-exporter\n+ ip addr del 192.0.2.202/32 dev lo\nRTNETLINK answers: Cannot assign requested address\n+ true\n"
2024-06-17T19:39:26.5139131Z   Jun 17 19:39:26.513: INFO: stdout: ""
2024-06-17T19:39:26.5140143Z   STEP: Destroying namespace "services-7471" for this suite. @ 06/17/24 19:39:26.513
2024-06-17T19:39:26.5187769Z • [16.054 seconds]
2024-06-17T19:39:26.5188505Z ------------------------------

verified, other two red lanes are not related to this PR merging this thanks @kyrtapz