OCPBUGS-27222: Allow modified IPv6 address as CPIC name

[dulek]

CloudPrivateIPConfig's name is supposed to be an IPv4 or IPv6 address. However, the K8s constraints do not allow colons in the names of the resources, so for IPv6 addresses the names are the addresses fully expanded with colons replaced with dots. E.g. fc00:f853:ccd:e793::54 becomes fc00.f853.0ccd.e793.0000.0000.0000.0054. This means that standard K8s validation of format: ipv6 will not work as it'll try parsing the address using golang's net library and that will fail due to s/\:/\./.

This commit replaces format: ipv6 with a pattern that matches fully expanded IPv6 addresses to fix the problem.

[openshift-ci-robot]

@dulek: This pull request references Jira Issue OCPBUGS-27222, which is invalid:

• expected the bug to target the "4.16.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

CloudPrivateIPConfig's name is supposed to be an IPv4 or IPv6 address. However, the K8s constraints do not allow colons in the names of the resources, so for IPv6 addresses the names are the addresses fully expanded with colons replaced with dots. E.g. fc00:f853:ccd:e793::54 becomes fc00.f853.0ccd.e793.0000.0000.0000.0054. This means that standard K8s validation of format: ipv6 will not work as it'll try parsing the address using golang's net library and that will fail due to s/\:/\./.

This commit replaces format: ipv6 with a pattern that matches fully expanded IPv6 addresses to fix the problem.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @dulek! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[dulek]

/jira refresh

[openshift-ci-robot]

@dulek: This pull request references Jira Issue OCPBUGS-27222, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (itbrown@redhat.com), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rlobillo]

tested locally with ipv6 subnet in dhcpv6-stateful mode, egressip worked fine:

$ oc logs -n openshift-cloud-network-config-controller cloud-network-config-controller-5ddb9f5d5-qjh4f -f
I0117 09:16:53.720283       1 controller.go:182] Assigning key: fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333 to cloud-private-ip-config workqueue                                                                                                 
I0117 09:16:53.738250       1 cloudprivateipconfig_controller.go:357] CloudPrivateIPConfig: "fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333" will be added to node: "ostest-htmv5-worker-0-8rpwc"                                                   
I0117 09:16:53.761037       1 controller.go:182] Assigning key: fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333 to cloud-private-ip-config workqueue                                                                                                 
I0117 09:16:53.761226       1 cloudprivateipconfig_controller.go:381] Adding finalizer to CloudPrivateIPConfig: "fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333"                                                                                    
I0117 09:16:54.951873       1 openstack.go:760] Getting port lock for portID b29ff3cd-1771-4a8f-ad3d-67a928660837 and IP fd2e:6f44:5dd8:c956:f816:3eff:fef0:3333                                                                             
I0117 09:16:55.570248       1 cloudprivateipconfig_controller.go:439] Added IP address to node: "ostest-htmv5-worker-0-8rpwc" for CloudPrivateIPConfig: "fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333"                                            
I0117 09:16:55.586648       1 controller.go:160] Dropping key 'fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333' from the cloud-private-ip-config workqueue                                                                                           
I0117 09:16:55.622946       1 controller.go:160] Dropping key 'fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333' from the cloud-private-ip-config workqueue

$ oc get egressip
NAME                    EGRESSIPS                                 ASSIGNED NODE                 ASSIGNED EGRESSIPS
egress-dualstack-ipv6   fd2e:6f44:5dd8:c956:f816:3eff:fef0:3333   ostest-htmv5-worker-0-8rpwc   fd2e:6f44:5dd8:c956:f816:3eff:fef0:3333
$ oc get cloudprivateipconfig -o wide
NAME                                      AGE
fd2e.6f44.5dd8.c956.f816.3eff.fef0.3333   87m

[kyrtapz]

Thanks @dulek!
/lgtm

format: ipv6 is not a valid name format, it was never possible to create a CloudPrivateIPConfig with an IPv6 as a name since it is not a valid dns subdomain .
This bug fell through the cracks as IPv6 EgressIP was not verified on cloud clusters until now: https://redhat-internal.slack.com/archives/CDCP2LA9L/p1705425974742159
CloudPrivateIPConfig resource is not directly managed by the user, it is created by ovn-kubernetes based on the corresponding EgressIP.

As per https://github.com/openshift/enhancements/blob/master/enhancements/network/cloud-egress-ip.md#crd:

Note: the kube API server does not accept resource names which do not adhere to RFC-1123, see the [kubernetes documentation on resource names](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#dns-subdomain-names). 
This means that the network plugins will not be able to create a CloudPrivateIPConfig for IPv6 addresses. The network plugins will hence be required to:
    expand the IPv6 address to its fully expanded form
    replace all colons with dots in the fully expanded IPv6 address

The reverse will naturally be required if the network plugins need to read the CloudPrivateIPConfig name.

This is already done in ovn-kubernetes:
https://github.com/ovn-org/ovn-kubernetes/blob/63641aa8b5faa50be2e7f33b49a6d95c1eacf36e/go-controller/pkg/clustermanager/egressip_controller.go#L174-L197 but is blocked by the invalid validation as seen in the bug.

[kyrtapz]

/lgtm

[danwinship]

/approve

the K8s constraints do not allow colons in the names of the resources

the kube API server does not accept resource names which do not adhere to RFC-1123

FTR, this is not true, and the linked doc even agrees ("Most resource types require a name that can be used as a DNS subdomain name", emphasis added). The networkingv1.IPAddress type used by KEP-1880 allows IPv6 addresses as names (unit test).

It's possible that CRD validation forces the RFC-1123 constraint? I'm not exactly sure where in the code the top level of CRD validation is. At any rate, as Patryk notes, we have defined CloudPrivateIPConfig to work in this particular way already, so...

[JoelSpeed]

With the new validation you are requiring that each segment in the IP address is fully spelt out, with no abbreviation (::) syntax, I think it's pretty hard to make a valid regex that will work here, but I wanted to make sure we all understand that caveat?

[danwinship]

Yup. You can see that in the ovn-k code Patryk linked to:

// The string representation of the IPv6 address fc00:f853:ccd:e793::54 will be
// represented as: fc00.f853.0ccd.e793.0000.0000.0000.0054

[JoelSpeed]

/lgtm

[dulek]

/assign @sjenning

[JoelSpeed]

Nit, please restore the final new line character

[JoelSpeed]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, dulek, JoelSpeed, kyrtapz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dulek: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@dulek: Jira Issue OCPBUGS-27222: All pull requests linked via external trackers have merged:

• openshift/api#1727

Jira Issue OCPBUGS-27222 has been moved to the MODIFIED state.

In response to this:

CloudPrivateIPConfig's name is supposed to be an IPv4 or IPv6 address. However, the K8s constraints do not allow colons in the names of the resources, so for IPv6 addresses the names are the addresses fully expanded with colons replaced with dots. E.g. fc00:f853:ccd:e793::54 becomes fc00.f853.0ccd.e793.0000.0000.0000.0054. This means that standard K8s validation of format: ipv6 will not work as it'll try parsing the address using golang's net library and that will fail due to s/\:/\./.

This commit replaces format: ipv6 with a pattern that matches fully expanded IPv6 addresses to fix the problem.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-cluster-config-api-container-v4.16.0-202401311812.p0.g4a45f44.assembly.stream for distgit ose-cluster-config-api.
All builds following this will include this PR.

[dulek]

/cherry-pick release-4.15

[openshift-cherrypick-robot]

@dulek: #1727 failed to apply on top of branch "release-4.15":

Applying: Allow modified IPv6 address as CPIC name
Using index info to reconstruct a base tree...
M	cloudnetwork/v1/001-cloudprivateipconfig.crd.yaml
Falling back to patching base and 3-way merge...
Auto-merging cloudnetwork/v1/001-cloudprivateipconfig.crd.yaml
CONFLICT (content): Merge conflict in cloudnetwork/v1/001-cloudprivateipconfig.crd.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Allow modified IPv6 address as CPIC name
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-4.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-02-02-224339

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-02-17-013806