Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bump ovs/ovn versions #2254

Merged
merged 4 commits into from
Jan 29, 2023
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
21 changes: 9 additions & 12 deletions .github/workflows/build-windows.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ concurrency:

env:
GO_VERSION: '1.19'
GOSEC_VERSION: '2.13.1'
GOSEC_VERSION: '2.14.0'

jobs:
build-ovs-and-ovn:
Expand All @@ -37,41 +37,38 @@ jobs:
uses: actions/checkout@v3
with:
repository: openvswitch/ovs
ref: branch-2.17
ref: branch-3.1
path: ovs

- name: Check out OVN
uses: actions/checkout@v3
with:
repository: ovn-org/ovn
ref: branch-22.03
ref: branch-22.12
path: ovn

- name: Apply OVS patches
working-directory: ovs
run: |
# ovsdb-idl: Support write-only-changed IDL monitor mode
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/03ce8faf7d0eb79d7dd99f4310dc15be160e92fc.patch" -OutFile ..\ovs-01.patch
# fix kernel crash
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/64383c14a9c25e9e0ca53c6758d9499c60132536.patch" -OutFile ..\ovs-02.patch
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/64383c14a9c25e9e0ca53c6758d9499c60132536.patch" -OutFile ..\ovs-01.patch
# support for building in github actions
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/08a95db2ca506fce4d89fdf4fafab74607b2bb9f.patch" -OutFile ..\ovs-03.patch
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/08a95db2ca506fce4d89fdf4fafab74607b2bb9f.patch" -OutFile ..\ovs-02.patch
# listen on tcp 127.0.0.1:6643 by default
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/680e77a190ae7df3086bc35bb6150238e97f9020.patch" -OutFile ..\ovs-04.patch
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovs/commit/680e77a190ae7df3086bc35bb6150238e97f9020.patch" -OutFile ..\ovs-03.patch
git apply ..\ovs-01.patch
git apply ..\ovs-02.patch
git apply ..\ovs-03.patch
git apply ..\ovs-04.patch

- name: Apply OVN patches
working-directory: ovn
run: |
# change hash type from dp_hash to hash with field src_ip
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovn/commit/ab923b252271cbbcccc8091e338ee7efe75e5fcd.patch" -OutFile ..\ovn-01.patch
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovn/commit/ae04d5e75d443500d537084d7db466513f63a7af.patch" -OutFile ..\ovn-01.patch
# add support for windows
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovn/commit/700870525ffbbccb70c6b00ca0f807b2a387e6ee.patch" -OutFile ..\ovn-02.patch
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovn/commit/05e57b322758461c54d5cad030486c3d25942c73.patch" -OutFile ..\ovn-02.patch
# set br-int controller to TCP 127.0.0.1:6653
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovn/commit/e498c03eda80248dd786775d8f7779d9b895e3ff.patch" -OutFile ..\ovn-03.patch
Invoke-WebRequest -Uri "https://github.com/kubeovn/ovn/commit/0181b68be18e96bc4ca68a0c3e5082da34c9dcdd.patch" -OutFile ..\ovn-03.patch
git apply ..\ovn-01.patch
git apply ..\ovn-02.patch
git apply ..\ovn-03.patch
Expand Down
71 changes: 68 additions & 3 deletions .github/workflows/build-x86-image.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,46 @@ env:
HELM_VERSION: v3.10.1

jobs:
build-kube-ovn-base:
name: Build kube-ovn-base
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 2
- uses: docker/setup-buildx-action@v2
if: github.base_ref != null
- name: Build
run: |
touch .CI_PASSED_VAR
if git diff --name-only HEAD^ HEAD | grep -q ^dist/images/Dockerfile.base$; then
echo "BUILD_BASE=1" > .CI_PASSED_VAR
echo "BUILD_BASE=1" >> "$GITHUB_ENV"
make base-amd64
make base-tar-amd64
fi
if git diff --name-only HEAD^ HEAD | grep -q ^dist/images/Dockerfile.base-dpdk$; then
make base-amd64-dpdk
fi

- name: Upload variable file to artifact
uses: actions/upload-artifact@v3
with:
name: variables
path: .CI_PASSED_VAR

- name: Upload base images to artifact
if: env.BUILD_BASE == 1
uses: actions/upload-artifact@v3
with:
name: kube-ovn-base
path: image-amd64.tar

build-kube-ovn:
name: Build kube-ovn
runs-on: ubuntu-22.04
needs:
- build-kube-ovn-base
steps:
- uses: actions/checkout@v3
- uses: docker/setup-buildx-action@v2
Expand Down Expand Up @@ -57,14 +94,43 @@ jobs:
make ut

- name: Install gosec
run: curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s -- -b $(go env GOPATH)/bin 'v${{ env.GOSEC_VERSION }}'
run: |
curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | \
sed 's#giturl=.*#giturl="https://api.github.com/repos/${owner_repo}/releases/tags/${version}"#' | \
sed 's#tag_name":"#tag_name": *"#' | \
sh -s -- -b $(go env GOPATH)/bin 'v${{ env.GOSEC_VERSION }}'

- name: Download variable file
uses: actions/download-artifact@v3
with:
name: variables

- name: Export passed variables
run: cat .CI_PASSED_VAR >> "$GITHUB_ENV"

- name: Download base images
if: env.BUILD_BASE == 1
uses: actions/download-artifact@v3
with:
name: kube-ovn-base

- name: Load base images
if: env.BUILD_BASE == 1
run: docker load --input image-amd64.tar

- name: Build
run: |
go mod tidy
git diff --exit-code
make lint
make image-kube-ovn
if [ "x${{ env.BUILD_BASE }}" = "x1" ]; then
TAG=$(cat VERSION)
docker tag kubeovn/kube-ovn-base:$TAG-amd64 kubeovn/kube-ovn-base:$TAG
docker tag kubeovn/kube-ovn-base:$TAG-amd64-no-avx512 kubeovn/kube-ovn-base:$TAG-no-avx512
make build-kube-ovn
else
make image-kube-ovn
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On Mac the docker buildx will always try to retrieve the remote base image, not sure if the behavior will change if runs on Linux.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

build-kube-ovn is a newly added makefile target, and it does not use buildx.

fi
make tar-kube-ovn

- name: Upload images to artifact
Expand All @@ -78,7 +144,6 @@ jobs:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v3
- uses: docker/setup-buildx-action@v2

- name: Build
run: |
Expand Down
26 changes: 16 additions & 10 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,15 @@ build-go-arm:
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -buildmode=pie -o $(CURDIR)/dist/images/kube-ovn-cmd -ldflags $(GOLDFLAGS) -v ./cmd
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -buildmode=pie -o $(CURDIR)/dist/images/kube-ovn-webhook -ldflags $(GOLDFLAGS) -v ./cmd/webhook

.PHONY: build-kube-ovn
build-kube-ovn: build-go
docker build -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG) -f dist/images/Dockerfile dist/images/
docker build -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG)-no-avx512 -f dist/images/Dockerfile.no-avx512 dist/images/
docker build -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG)-dpdk -f dist/images/Dockerfile.dpdk dist/images/

.PHONY: build-dev
build-dev: build-go
docker build --build-arg ARCH=amd64 -t $(REGISTRY)/kube-ovn:$(DEV_TAG) -f dist/images/Dockerfile dist/images/
docker build -t $(REGISTRY)/kube-ovn:$(DEV_TAG) -f dist/images/Dockerfile dist/images/

.PHONY: build-dpdk
build-dpdk:
Expand All @@ -69,34 +75,34 @@ base-arm64:

.PHONY: image-kube-ovn
image-kube-ovn: build-go
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG) -o type=docker -f dist/images/Dockerfile dist/images/
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG)-no-avx512 -o type=docker -f dist/images/Dockerfile.no-avx512 dist/images/
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG)-dpdk -o type=docker -f dist/images/Dockerfile.dpdk dist/images/
docker buildx build --platform linux/amd64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG) -o type=docker -f dist/images/Dockerfile dist/images/
docker buildx build --platform linux/amd64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG)-no-avx512 -o type=docker -f dist/images/Dockerfile.no-avx512 dist/images/
docker buildx build --platform linux/amd64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG)-dpdk -o type=docker -f dist/images/Dockerfile.dpdk dist/images/

.PHONY: image-debug
image-debug: build-go
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/kube-ovn:debug -o type=docker -f dist/images/Dockerfile.debug dist/images/

.PHONY: image-vpc-nat-gateway
image-vpc-nat-gateway:
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/vpc-nat-gateway:$(RELEASE_TAG) -o type=docker -f dist/images/vpcnatgateway/Dockerfile dist/images/vpcnatgateway
docker buildx build --platform linux/amd64 -t $(REGISTRY)/vpc-nat-gateway:$(RELEASE_TAG) -o type=docker -f dist/images/vpcnatgateway/Dockerfile dist/images/vpcnatgateway

.PHONY: image-centos-compile
image-centos-compile:
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/centos7-compile:$(RELEASE_TAG) -o type=docker -f dist/images/compile/centos7/Dockerfile fastpath/
# docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/centos8-compile:$(RELEASE_TAG) -o type=docker -f dist/images/compile/centos8/Dockerfile fastpath/
docker buildx build --platform linux/amd64 -t $(REGISTRY)/centos7-compile:$(RELEASE_TAG) -o type=docker -f dist/images/compile/centos7/Dockerfile fastpath/
# docker buildx build --platform linux/amd64 -t $(REGISTRY)/centos8-compile:$(RELEASE_TAG) -o type=docker -f dist/images/compile/centos8/Dockerfile fastpath/

.PHOONY: image-test
image-test: build-go
docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 -t $(REGISTRY)/test:$(RELEASE_TAG) -o type=docker -f dist/images/Dockerfile.test dist/images/
docker buildx build --platform linux/amd64 -t $(REGISTRY)/test:$(RELEASE_TAG) -o type=docker -f dist/images/Dockerfile.test dist/images/

.PHONY: release
release: lint image-kube-ovn image-vpc-nat-gateway image-centos-compile

.PHONY: release-arm
release-arm: build-go-arm
docker buildx build --platform linux/arm64 --build-arg ARCH=arm64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG) -o type=docker -f dist/images/Dockerfile dist/images/
docker buildx build --platform linux/arm64 --build-arg ARCH=arm64 -t $(REGISTRY)/vpc-nat-gateway:$(RELEASE_TAG) -o type=docker -f dist/images/vpcnatgateway/Dockerfile dist/images/vpcnatgateway
docker buildx build --platform linux/arm64 -t $(REGISTRY)/kube-ovn:$(RELEASE_TAG) -o type=docker -f dist/images/Dockerfile dist/images/
docker buildx build --platform linux/arm64 -t $(REGISTRY)/vpc-nat-gateway:$(RELEASE_TAG) -o type=docker -f dist/images/vpcnatgateway/Dockerfile dist/images/vpcnatgateway

.PHONY: push-dev
push-dev:
Expand Down
66 changes: 28 additions & 38 deletions dist/images/Dockerfile.base
Original file line number Diff line number Diff line change
Expand Up @@ -6,76 +6,68 @@ ARG NO_AVX512=false
ARG DEBIAN_FRONTEND=noninteractive
ENV SRC_DIR='/usr/src'

RUN apt update && apt install build-essential git libnuma-dev autoconf curl \
python3 libmnl-dev libpcap-dev libtool libcap-ng-dev libssl-dev pkg-config \
python3-six libunbound-dev libunwind-dev dh-make fakeroot debhelper dh-python \
flake8 python3-sphinx graphviz groff wget -y
RUN apt update && apt install -y build-essential fakeroot git curl \
autoconf automake bzip2 debhelper-compat dh-exec dh-python dh-sequence-python3 dh-sequence-sphinxdoc \
graphviz iproute2 libcap-ng-dev libdbus-1-dev libnuma-dev libpcap-dev libssl-dev libtool libunbound-dev \
openssl pkg-config procps python3-all-dev python3-setuptools python3-sortedcontainers python3-sphinx

RUN cd /usr/src/ && \
git clone -b branch-2.17 --depth=1 https://github.com/openvswitch/ovs.git && \
git clone -b branch-3.1 --depth=1 https://github.com/openvswitch/ovs.git && \
cd ovs && \
# ovsdb-idl: Support write-only-changed IDL monitor mode
curl -s https://github.com/kubeovn/ovs/commit/03ce8faf7d0eb79d7dd99f4310dc15be160e92fc.patch | git apply && \
# fix memleak
curl -s https://github.com/kubeovn/ovs/commit/2dc8e7aa202818952b2fa80b47298604530c9de0.patch | git apply && \
# fix log file descriptor leak in monitor process
curl -s https://github.com/kubeovn/ovs/commit/918d6dc79634bec760054ee53f7628186315bcfb.patch | git apply && \
# fix memory leak by ofport_usage and trim memory periodically
curl -s https://github.com/kubeovn/ovs/commit/10972d963208490c5fe6ff66247b86b947136da6.patch | git apply && \
# increase election timer
curl -s https://github.com/kubeovn/ovs/commit/22ea22c40b46ee5adeae977ff6cfca81b3ff25d7.patch | git apply && \
curl -s https://github.com/kubeovn/ovs/commit/38df6fa3f721dc53464fcff61dbc2bc79c710ab1.patch | git apply && \
# add fdb update logging
curl -s https://github.com/kubeovn/ovs/commit/8c2f28b778129161bbf8f0738fa41d385860d5bc.patch | git apply && \
curl -s https://github.com/kubeovn/ovs/commit/d4888c4e75f2288d8ff4f04ee57538659f118f5b.patch | git apply && \
# fdb: fix mac learning in environments with hairpin enabled
curl -s https://github.com/kubeovn/ovs/commit/1cb138aaf2fdf922d75a587e4e9cf610d38f9fee.patch | git apply && \
curl -s https://github.com/kubeovn/ovs/commit/403fbd0f6561c8985302734608c2de659671c563.patch | git apply && \
# ovsdb-tool: add optional server id parameter for "join-cluster" command
curl -s https://github.com/kubeovn/ovs/commit/2e2ec1161cadbec79786d63fde9475053d996586.patch | git apply && \
curl -s https://github.com/kubeovn/ovs/commit/9a81b91368b27afda97657a8864b729dc2e029e2.patch | git apply && \
# compile without avx512
if [ "$ARCH" = "amd64" -a "$NO_AVX512" = "true" ]; then curl -s https://github.com/kubeovn/ovs/commit/c257b0794b827cfae9660a9f3238bee8a29e7676.patch | git apply; fi && \
if [ "$ARCH" = "amd64" -a "$NO_AVX512" = "true" ]; then curl -s https://github.com/kubeovn/ovs/commit/97f9f85a277e5372af6e3cd899cab1b63f6f6b44.patch | git apply; fi && \
./boot.sh && \
./configure && \
rm -rf .git && \
CONFIGURE_OPTS='' && \
if [ "$ARCH" = "amd64" ]; then CONFIGURE_OPTS='CFLAGS="-O2 -g -msse4.2 -mpopcnt"'; fi && \
DATAPATH_CONFIGURE_OPTS='--prefix=/usr' EXTRA_CONFIGURE_OPTS=$CONFIGURE_OPTS DEB_BUILD_OPTIONS='parallel=8 nocheck' fakeroot debian/rules binary
if [ "$ARCH" = "amd64" ]; then CONFIGURE_OPTS='CFLAGS="-O2 -g -msse4.2 -mpopcnt -fPIC"'; fi && \
DATAPATH_CONFIGURE_OPTS='--prefix=/usr' EXTRA_CONFIGURE_OPTS=$CONFIGURE_OPTS DEB_BUILD_OPTIONS='parallel=8 nocheck nodpdk' make debian-deb

RUN dpkg -i /usr/src/python3-openvswitch*.deb /usr/src/libopenvswitch*.deb
RUN dpkg -i /usr/src/python3-openvswitch*.deb

RUN cd /usr/src/ && git clone -b branch-22.03 --depth=1 https://github.com/ovn-org/ovn.git && \
RUN cd /usr/src/ && git clone -b branch-22.12 --depth=1 https://github.com/ovn-org/ovn.git && \
cd ovn && \
# fix ssl listen address
curl -s https://github.com/kubeovn/ovn/commit/62d4969877712c26fe425698d898b440f91b44bf.patch | git apply && \
# ovn-controller: Add a generic way to check if the daemon started recently.
curl -s https://github.com/kubeovn/ovn/commit/367d7ab6239089ce99dda20818c8833c69ffd77f.patch | git apply && \
# patch.c: Avoid patch interface deletion & recreation during restart.
curl -s https://github.com/kubeovn/ovn/commit/e4b97b4961fa80071cb73aa40cf97f586f55b1eb.patch | git apply && \
# do not send traffic that not designate to svc to conntrack
curl -s https://github.com/kubeovn/ovn/commit/d26ae4de0ab070f6b602688ba808c8963f69d5c4.patch | git apply && \
curl -s https://github.com/kubeovn/ovn/commit/0700cb90f950db1fb43490545dd4fc41afa46d70.patch | git apply && \
# change hash type from dp_hash to hash with field src_ip
curl -s https://github.com/kubeovn/ovn/commit/ab923b252271cbbcccc8091e338ee7efe75e5fcd.patch | git apply && \
curl -s https://github.com/kubeovn/ovn/commit/c48049a64fedb1278f9158770a12751ee5bfc358.patch | git apply && \
# set ether dst addr for dnat on logical switch
curl -s https://github.com/kubeovn/ovn/commit/58a40438926745dfdd498c09ea71e1746b803a42.patch | git apply && \
curl -s https://github.com/kubeovn/ovn/commit/540592b9fff8c5574ae605086fdaa16b718551f7.patch | git apply && \
# modify src route priority
curl -s https://github.com/kubeovn/ovn/commit/e0e20deb188434f73143b1906e481fdac913429d.patch | git apply && \
curl -s https://github.com/kubeovn/ovn/commit/b3801ecb732a788efd2380a7daca4e2a7726128e.patch | git apply && \
# fix reaching resubmit limit in underlay
curl -s https://github.com/kubeovn/ovn/commit/f531458f2076fc89419a2ce58974230b7be7b76c.patch | git apply && \
curl -s https://github.com/kubeovn/ovn/commit/977e569539893460cd27b2287d6042b62079ea65.patch | git apply && \
sed -i 's/OVN/ovn/g' debian/changelog && \
rm -rf .git && \
./boot.sh && \
CONFIGURE_OPTS='' && \
if [ "$ARCH" = "amd64" ]; then CONFIGURE_OPTS='CFLAGS="-O2 -g -msse4.2 -mpopcnt"'; fi && \
CONFIGURE_OPTS='--with-ovs-build=/usr/src/ovs/_debian' && \
if [ "$ARCH" = "amd64" ]; then CONFIGURE_OPTS="$CONFIGURE_OPTS CFLAGS='-O2 -g -msse4.2 -mpopcnt -fPIC'"; fi && \
OVSDIR=/usr/src/ovs EXTRA_CONFIGURE_OPTS=$CONFIGURE_OPTS DEB_BUILD_OPTIONS='parallel=8 nocheck' fakeroot debian/rules binary

RUN mkdir /packages/ && \
cp /usr/src/libopenvswitch*.deb /packages && \
cp /usr/src/openvswitch-*.deb /packages && \
cp /usr/src/python3-openvswitch*.deb /packages && \
cp /usr/src/ovn-*.deb /packages && \
cd /packages && rm -f *dbg* *datapath* *docker* *vtep* *ipsec* *test* *dev*
cd /packages && rm -f *source* *dbg* *datapath* *docker* *vtep* *ipsec* *test* *dev*

FROM ubuntu:22.04

ARG DEBIAN_FRONTEND=noninteractive
RUN apt update && apt upgrade -y && apt install ca-certificates python3 hostname libunwind8 netbase \
ethtool iproute2 ncat libunbound-dev procps libatomic1 kmod iptables \
tcpdump ipset curl uuid-runtime openssl inetutils-ping arping ndisc6 \
ethtool iproute2 ncat libunbound-dev procps libatomic1 kmod iptables python3-netifaces python3-sortedcontainers \
tcpdump ipset curl uuid-runtime openssl inetutils-ping arping ndisc6 libjs-sphinxdoc \
zhangzujian marked this conversation as resolved.
Show resolved Hide resolved
logrotate dnsutils net-tools -y --no-install-recommends && \
rm -rf /var/lib/apt/lists/* && \
cd /usr/sbin && \
Expand All @@ -98,9 +90,7 @@ RUN curl -L https://dl.k8s.io/${KUBE_VERSION}/kubernetes-client-linux-${ARCH}.ta
&& chmod +x /usr/bin/kubectl && rm -rf ./kubernetes

RUN --mount=type=bind,target=/packages,from=ovs-builder,source=/packages \
dpkg -i /packages/libopenvswitch*.deb && \
dpkg -i /packages/openvswitch-*.deb && \
dpkg -i /packages/python3-openvswitch*.deb && \
dpkg -i /packages/openvswitch-*.deb /packages/python3-openvswitch*.deb && \
dpkg -i --ignore-depends=openvswitch-switch,openvswitch-common /packages/ovn-*.deb && \
rm -rf /var/lib/openvswitch/pki/

Expand Down