OCPBUGS-15331,OCPBUGS-16049: Enable AdvertiseAddress dual stack and IPv6 support and added the changes to be included in the certificates #2779

jparrill · 2023-07-07T14:15:28Z

Changes:

Now IPv6 and Dual Stack scenarios are covered in self-hosted environments.
KAS PKI modified to include IPv4/6 addresses into the certificate
Proxy still support only single stack scenarios, using the first ServiceCIDR as a AdvertiseAddress or InternalAPIAddress, but IPv4 and IPv6 could be used in any case (this is temporary meanwhile the Issue mentioned down bellow is open).

Which issue(s) this PR fixes :
Fixes #OCPBUGS-15331
Fixes #OCPBUGS-16049

Caveats:

DualStack apiserver support kubernetes/enhancements#2438 - This issue prevents the KAS to support dual stack and the AdvertiseAddress even being an slice, it only supports only one element (if more provided it will take the last one as the AdvertiseAddress).

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci · 2023-07-07T14:15:32Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2023-07-07T14:15:35Z

@jparrill: This pull request references Jira Issue OCPBUGS-15331, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This PR involve the some changes:

Added a new API endpoint under APIServerNetworking spec, this new endpoint avoids to break the API retrocompatibility with older versions and enables the capability to hold more than one Ip in the AdvertiseAddress in KAS.

Now IPv6 and Dual Stack scenarios are covered in self-hosted environments.

PKI and Proxy still support only single stack scenarios, using the first ServiceCIDR as a AdvertiseAddress or InternalAPIAddress, but IPv4 and IPv6 could be used in any case.

What this PR does / why we need it:

Which issue(s) this PR fixes :
Fixes #OCPBUGS-15331

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

netlify · 2023-07-07T14:16:11Z

✅ Deploy Preview for hypershift-docs ready!

Name	Link
🔨 Latest commit	`30fedd3`
🔍 Latest deploy log	https://app.netlify.com/sites/hypershift-docs/deploys/64d5e744e30f9d0008a787ea
😎 Deploy Preview	https://deploy-preview-2779--hypershift-docs.netlify.app/reference/api
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

openshift-ci-robot · 2023-07-11T17:23:44Z

@jparrill: This pull request references Jira Issue OCPBUGS-15331, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Changes:

Added a new API endpoint under APIServerNetworking spec, this new endpoint avoids to break the API retrocompatibility with older versions and enables the capability to hold more than one Ip in the AdvertiseAddress in KAS.

Now IPv6 and Dual Stack scenarios are covered in self-hosted environments.

PKI and Proxy still support only single stack scenarios, using the first ServiceCIDR as a AdvertiseAddress or InternalAPIAddress, but IPv4 and IPv6 could be used in any case.

Which issue(s) this PR fixes :
Fixes #OCPBUGS-15331

Caveats:

DualStack apiserver support kubernetes/enhancements#2438 - This issue prevents the KAS to support dual stack and the AdvertiseAddress even being an slice, it only supports only one element (if more provided it will take the last one as the AdvertiseAddress)

I've added an API endpoint in Beta supporting multiple AdvertiseAddresses and also added support for the controllers and utilities, so we only need to delete this break code in order to make that work, we also need to fix the unit tests, covering the new behaviour.

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

hypershift-operator/controllers/nodepool/haproxy.go

support/util/util.go

support/util/networking.go

api/v1beta1/hostedcluster_types.go

jparrill · 2023-08-10T11:32:46Z

/test e2e-kubevirt-aws-ovn

csrwng

Some comments, thx!

api/v1beta1/hostedcluster_types.go

openshift-ci-robot · 2023-08-10T15:30:46Z

@jparrill: This pull request references Jira Issue OCPBUGS-15331, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

This pull request references Jira Issue OCPBUGS-16049, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @LiangquanLi930

In response to this:

Changes:

Now IPv6 and Dual Stack scenarios are covered in self-hosted environments.

KAS PKI modified to include IPv4/6 addresses into the certificate

Proxy still support only single stack scenarios, using the first ServiceCIDR as a AdvertiseAddress or InternalAPIAddress, but IPv4 and IPv6 could be used in any case (this is temporary meanwhile the Issue mentioned down bellow is open).

Which issue(s) this PR fixes :
Fixes #OCPBUGS-15331
Fixes #OCPBUGS-16049

Caveats:

DualStack apiserver support kubernetes/enhancements#2438 - This issue prevents the KAS to support dual stack and the AdvertiseAddress even being an slice, it only supports only one element (if more provided it will take the last one as the AdvertiseAddress).

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

csrwng

Thank you Juan, some additional comments

support/util/networking.go

api/v1beta1/hostedcluster_types.go

support/util/networking.go

hypershift-operator/controllers/nodepool/haproxy.go

support/util/networking_test.go

support/util/types.go

csrwng · 2023-08-11T03:55:00Z

support/util/util.go

+	ip := ipNet.IP
+	if ip.To4() != nil {
+		// IPv4
+		ip[net.IPv4len-1]++


both the ipv4 and ipv6 cases seem to be doing the same thing, so ip[len(ip)-1]++ should work for both, I don't think there's a need to differentiate.

If I do that this is the result in the unitTests:

FirstUsableIP() = 2000::, want 2000::1

I tested ip[len(ip)-1]++ for all cases and it passes for me

support/util/util.go

jparrill · 2023-08-11T11:53:24Z

/test e2e-aws

…IPv6 support and fixes KAS certs Changes included for OCPBUGS-15331: - Now IPv6 and Dual Stack scenarios are covered in self-hosted environments. - PKI and Proxy still support only single stack scenarios, using the first ServiceCIDR as a AdvertiseAddress or InternalAPIAddress, but IPv4 and IPv6 could be used in any case. Changes included for OCPBUGS-16049: - KAS Certificates now includes the proper SAN for dual stack scenarios Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>

csrwng · 2023-08-11T14:14:52Z

/approve

openshift-ci · 2023-08-11T14:15:43Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csrwng, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [csrwng]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

imain · 2023-08-11T21:37:01Z

/lgtm

jparrill · 2023-08-11T21:46:16Z

/retest-required

csrwng · 2023-08-11T22:04:44Z

/override ci/prow/e2e-kubevirt-aws-ovn

openshift-ci · 2023-08-11T22:05:04Z

@csrwng: Overrode contexts on behalf of csrwng: ci/prow/e2e-kubevirt-aws-ovn

In response to this:

/override ci/prow/e2e-kubevirt-aws-ovn

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-08-11T22:20:53Z

/retest-required

Remaining retests: 0 against base HEAD cb96cd6 and 2 for PR HEAD 2a70e7e in total

jparrill · 2023-08-12T06:58:47Z

/test e2e-aws

openshift-ci · 2023-08-12T09:02:01Z

@jparrill: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ibmcloud-roks	`2a70e7e`	link	false	`/test e2e-ibmcloud-roks`
ci/prow/e2e-ibmcloud-iks	`2a70e7e`	link	false	`/test e2e-ibmcloud-iks`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-08-12T09:06:26Z

@jparrill: Jira Issue OCPBUGS-15331: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-15331 has been moved to the MODIFIED state.

Jira Issue OCPBUGS-16049: All pull requests linked via external trackers have merged:

openshift/hypershift#2779

Jira Issue OCPBUGS-16049 has been moved to the MODIFIED state.

In response to this:

Changes:

Now IPv6 and Dual Stack scenarios are covered in self-hosted environments.

KAS PKI modified to include IPv4/6 addresses into the certificate

Proxy still support only single stack scenarios, using the first ServiceCIDR as a AdvertiseAddress or InternalAPIAddress, but IPv4 and IPv6 could be used in any case (this is temporary meanwhile the Issue mentioned down bellow is open).

Which issue(s) this PR fixes :
Fixes #OCPBUGS-15331
Fixes #OCPBUGS-16049

Caveats:

DualStack apiserver support kubernetes/enhancements#2438 - This issue prevents the KAS to support dual stack and the AdvertiseAddress even being an slice, it only supports only one element (if more provided it will take the last one as the AdvertiseAddress).

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-merge-robot · 2023-09-16T01:20:33Z

Fix included in accepted release 4.14.0-0.nightly-2023-09-11-201102

openshift-merge-robot · 2023-09-17T02:22:19Z

Fix included in accepted release 4.14.0-0.nightly-2023-09-12-024050

openshift-merge-robot · 2023-09-17T12:09:02Z

Fix included in accepted release 4.14.0-0.nightly-2023-09-15-101929

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 7, 2023

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Jul 7, 2023

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jul 7, 2023

openshift-ci bot added the do-not-merge/needs-area label Jul 7, 2023

jparrill changed the title ~~OCPBUGS-15331: Enables AdvertiseAddress dual stack and IPv6 support~~ OCPBUGS-15331: Enable AdvertiseAddress dual stack and IPv6 support Jul 7, 2023

jparrill force-pushed the bug/OCPBUGS-15331 branch 2 times, most recently from c5a0d20 to 5a46cc4 Compare July 11, 2023 11:54

jparrill marked this pull request as ready for review July 12, 2023 06:47

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 12, 2023

openshift-ci bot requested review from enxebre and isco-rodriguez July 12, 2023 06:48

enxebre reviewed Jul 12, 2023

View reviewed changes

hypershift-operator/controllers/nodepool/haproxy.go Outdated Show resolved Hide resolved

muraee reviewed Jul 12, 2023

View reviewed changes

support/util/util.go Outdated Show resolved Hide resolved

muraee reviewed Jul 12, 2023

View reviewed changes

support/util/networking.go Outdated Show resolved Hide resolved

muraee reviewed Jul 12, 2023

View reviewed changes

api/v1beta1/hostedcluster_types.go Outdated Show resolved Hide resolved

jparrill force-pushed the bug/OCPBUGS-15331 branch 2 times, most recently from 82c2ee9 to 95c480e Compare July 12, 2023 11:07

jparrill marked this pull request as draft July 12, 2023 11:15

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 12, 2023

csrwng reviewed Aug 10, 2023

View reviewed changes

api/v1beta1/hostedcluster_types.go Outdated Show resolved Hide resolved

api/v1beta1/hostedcluster_types.go Outdated Show resolved Hide resolved

jparrill force-pushed the bug/OCPBUGS-15331 branch from 61ffd98 to a3a0e4b Compare August 10, 2023 15:07

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 10, 2023

jparrill force-pushed the bug/OCPBUGS-15331 branch from a3a0e4b to 52ee69b Compare August 10, 2023 15:29

openshift-ci bot requested a review from LiangquanLi930 August 10, 2023 15:30

csrwng reviewed Aug 11, 2023

View reviewed changes

jparrill force-pushed the bug/OCPBUGS-15331 branch from 52ee69b to 30fedd3 Compare August 11, 2023 07:46

jparrill force-pushed the bug/OCPBUGS-15331 branch from 30fedd3 to 9c33a8c Compare August 11, 2023 13:12

jparrill force-pushed the bug/OCPBUGS-15331 branch from 9c33a8c to 2a70e7e Compare August 11, 2023 14:12

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 11, 2023

openshift-ci bot assigned imain Aug 11, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2023

openshift-merge-robot merged commit dce6f51 into openshift:main Aug 12, 2023
13 of 15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-15331,OCPBUGS-16049: Enable AdvertiseAddress dual stack and IPv6 support and added the changes to be included in the certificates #2779

OCPBUGS-15331,OCPBUGS-16049: Enable AdvertiseAddress dual stack and IPv6 support and added the changes to be included in the certificates #2779

jparrill commented Jul 7, 2023 •

edited

openshift-ci bot commented Jul 7, 2023

openshift-ci-robot commented Jul 7, 2023

netlify bot commented Jul 7, 2023 •

edited

openshift-ci-robot commented Jul 11, 2023

Changes:

Caveats:

jparrill commented Aug 10, 2023

csrwng left a comment

openshift-ci-robot commented Aug 10, 2023

Changes:

Caveats:

csrwng left a comment

csrwng Aug 11, 2023

jparrill Aug 11, 2023

csrwng Aug 11, 2023

jparrill commented Aug 11, 2023

csrwng commented Aug 11, 2023

openshift-ci bot commented Aug 11, 2023

imain commented Aug 11, 2023

jparrill commented Aug 11, 2023

csrwng commented Aug 11, 2023

openshift-ci bot commented Aug 11, 2023

openshift-ci-robot commented Aug 11, 2023

jparrill commented Aug 12, 2023

openshift-ci bot commented Aug 12, 2023

openshift-ci-robot commented Aug 12, 2023

Changes:

Caveats:

openshift-merge-robot commented Sep 16, 2023

openshift-merge-robot commented Sep 17, 2023

openshift-merge-robot commented Sep 17, 2023

OCPBUGS-15331,OCPBUGS-16049: Enable AdvertiseAddress dual stack and IPv6 support and added the changes to be included in the certificates #2779

OCPBUGS-15331,OCPBUGS-16049: Enable AdvertiseAddress dual stack and IPv6 support and added the changes to be included in the certificates #2779

Conversation

jparrill commented Jul 7, 2023 • edited

Changes:

Caveats:

openshift-ci bot commented Jul 7, 2023

openshift-ci-robot commented Jul 7, 2023

netlify bot commented Jul 7, 2023 • edited

✅ Deploy Preview for hypershift-docs ready!

openshift-ci-robot commented Jul 11, 2023

Changes:

Caveats:

jparrill commented Aug 10, 2023

csrwng left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Aug 10, 2023

Changes:

Caveats:

csrwng left a comment

Choose a reason for hiding this comment

csrwng Aug 11, 2023

Choose a reason for hiding this comment

jparrill Aug 11, 2023

Choose a reason for hiding this comment

csrwng Aug 11, 2023

Choose a reason for hiding this comment

jparrill commented Aug 11, 2023

csrwng commented Aug 11, 2023

openshift-ci bot commented Aug 11, 2023

imain commented Aug 11, 2023

jparrill commented Aug 11, 2023

csrwng commented Aug 11, 2023

openshift-ci bot commented Aug 11, 2023

openshift-ci-robot commented Aug 11, 2023

jparrill commented Aug 12, 2023

openshift-ci bot commented Aug 12, 2023

openshift-ci-robot commented Aug 12, 2023

Changes:

Caveats:

openshift-merge-robot commented Sep 16, 2023

openshift-merge-robot commented Sep 17, 2023

openshift-merge-robot commented Sep 17, 2023

jparrill commented Jul 7, 2023 •

edited

netlify bot commented Jul 7, 2023 •

edited