fix br-external not init because of no permission after ovn-nat-gw co…

…nfigmap created (#3902)

* fix gw

* fix sa


---------

Signed-off-by: bobz965 <zhangbingbing2_yewu@cmss.chinamobile.com>

charts/kube-ovn/templates/ovn-CR.yaml

@@ -231,6 +231,14 @@ rules:
       - create
       - patch
       - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

dist/images/install.sh

@@ -3089,6 +3089,14 @@ rules:
       - create
       - patch
       - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

pkg/daemon/gateway_linux.go

@@ -1377,11 +1377,12 @@ func (c *Controller) setExGateway() error {
 			klog.Errorf("failed to get ovn-external-gw-config, %v", err)
 			return err
 		}
-		// enable external-gw-config without 'external-gw-nic' configured
-		// to reuse existing physical network from arg 'external-gateway-net'
+
 		linkName, exist := cm.Data["external-gw-nic"]
 		if !exist || len(linkName) == 0 {
-			return nil
+			err = fmt.Errorf("external-gw-nic not configured in ovn-external-gw-config")
+			klog.Error(err)
+			return err
 		}
 		link, err := netlink.LinkByName(linkName)
 		if err != nil {
@@ -1408,6 +1409,7 @@ func (c *Controller) setExGateway() error {
 		}
 
 		if !externalBrReady {
+			klog.Infof("create external bridge %s and add nic %s", externalBridge, linkName)
 			if _, err := ovs.Exec(
 				ovs.MayExist, "add-br", externalBridge, "--",
 				ovs.MayExist, "add-port", externalBridge, linkName,

pkg/daemon/gateway_windows.go

@@ -54,12 +54,14 @@ func (c *Controller) setExGateway() error {
 			klog.Errorf("failed to get ovn-external-gw-config, %v", err)
 			return err
 		}
-		// enable external-gw-config without 'external-gw-nic' configured
-		// to reuse existing physical network from arg 'external-gateway-net'
+
 		linkName, exist := cm.Data["external-gw-nic"]
 		if !exist || len(linkName) == 0 {
-			return nil
+			err = fmt.Errorf("external-gw-nic not configured in ovn-external-gw-config")
+			klog.Error(err)
+			return err
 		}
+
 		externalBrReady := false
 		// if external nic already attached into another bridge
 		if existBr, err := ovs.Exec("port-to-br", linkName); err == nil {

pkg/ovs/ovn-nb-bfd.go

@@ -69,16 +69,15 @@ func (c *OVNNbClient) DeleteBFD(lrpName, dstIP string) error {
 	if len(bfdList) == 0 {
 		return nil
 	}
-
 	for _, bfd := range bfdList {
 		ops, err := c.Where(&bfd).Delete()
 		if err != nil {
 			return fmt.Errorf("failed to generate operations for BFD deletion with UUID %s: %v", bfd.UUID, err)
 		}
+		klog.Infof("delete lrp %s BFD dst ip %s", lrpName, bfd.DstIP)
 		if err = c.Transact("bfd-del", ops); err != nil {
 			return fmt.Errorf("failed to delete BFD with with UUID %s: %v", bfd.UUID, err)
 		}
 	}
-
 	return nil
 }

yamls/sa.yaml

@@ -274,6 +274,14 @@ rules:
       - create
       - patch
       - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding