Skip to content

Commit bcfec9c

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #53 from npinaeva/improve-docs
Add user docs explaining main use-cases and commands for network-tools
2 parents 409105a + a356471 commit bcfec9c

6 files changed

Lines changed: 229 additions & 65 deletions

File tree

‎Dockerfile.fedora‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,15 @@
77
# this image in any production environment.
88
#
99

10-
FROM registry.ci.openshift.org/openshift/release:golang-1.15 AS builder
11-
WORKDIR /go/src/github.com/openshift/network-tools
12-
COPY . .
13-
14-
FROM fedora:32
15-
COPY --from=builder /go/src/github.com/openshift/network-tools/debug-scripts/* /usr/bin/
16-
RUN yum -y --setopt=tsflags=nodocs install git go nginx jq tcpdump traceroute wireshark net-tools nmap-ncat pciutils strace numactl make conntrack-tools perf iproute && \
10+
FROM fedora:latest
11+
RUN yum -y --setopt=tsflags=nodocs install git go nginx jq tcpdump traceroute wireshark net-tools nmap-ncat pciutils strace numactl make conntrack-tools perf iproute iputils && \
1712
yum clean all && rm -rf /var/cache/* && \
18-
curl https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.6.0/openshift-client-linux-4.6.0.tar.gz > /tmp/oc.tar.gz && \
13+
curl https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.9.0/openshift-client-linux-4.9.0.tar.gz > /tmp/oc.tar.gz && \
1914
tar xzvf /tmp/oc.tar.gz -C /usr/bin && \
2015
rm /tmp/oc.tar.gz && \
2116
# needed for ovnkube-trace
2217
git clone https://github.com/openshift/ovn-kubernetes.git /usr/bin/ovn-kubernetes && \
2318
pushd /usr/bin/ovn-kubernetes/go-controller && hack/build-go.sh cmd/ovnkube-trace && \
2419
mv _output/go/bin/ovnkube-trace /usr/bin/ovnkube-trace && popd && \
2520
rm -rf /usr/bin/ovn-kubernetes
21+
COPY ./debug-scripts/* /usr/bin/

‎debug-scripts/common‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ create_pod_on_node () {
1414
echo "INFO: Scheduling "$POD_NAME" on "$NODE_NAME""
1515

1616
oc run "$POD_NAME" --image=quay.io/openshift/origin-network-tools:latest \
17-
--overrides='{ "spec": { "nodeSelector": {"'"$POD_NAME"'": "network-tools-debug-role"} } }' \
17+
--overrides='{ "spec": { "nodeSelector": {"'"$POD_NAME"'": "network-tools-debug-role"}, "tolerations": [{"key": "node-role.kubernetes.io/master", "effect": "NoSchedule", "operator": "Exists"}] }}' \
1818
-- /sbin/init
1919

2020
# wait till pod is running
@@ -35,7 +35,8 @@ create_svc () {
3535
# TODO: Allow users to specify which svc type they want to test
3636
oc expose pod/"$SVC_NAME" --port=80
3737
# wait till svc endpoint is created
38-
while [[ $(oc get ep "$SVC_NAME" -o 'jsonpath={.subsets[0].addresses[0].ip}') == "" ]]; do echo "waiting for svc" && sleep 1; done
38+
WAIT_TIME=0
39+
while [[ $(oc get ep "$SVC_NAME" -o 'jsonpath={.subsets[0].addresses[0].ip}') == "" && ${WAIT_TIME} -le 30 ]]; do echo "waiting for svc" && ((WAIT_TIME++)) && sleep 1; done
3940
}
4041

4142
get_random_name () {
@@ -99,16 +100,6 @@ get_svc_ip () {
99100
oc get svc -n "$namespace" "$name" -o 'jsonpath={.spec.clusterIP}'
100101
}
101102

102-
get_current_namespace () {
103-
local namespace=$(oc config view --minify --output 'jsonpath={..namespace}')
104-
if [ -z "$namespace" ];
105-
then
106-
echo "default"
107-
else
108-
oc config view --minify --output 'jsonpath={..namespace}'
109-
fi
110-
}
111-
112103
run_command_inside_pod_network_namespace() {
113104
local namespace="${1}"
114105
local pod="${2}"
@@ -120,7 +111,7 @@ run_command_inside_pod_network_namespace() {
120111
ans=$(oc debug \
121112
node/$(get_pod_node "$namespace" "$pod") \
122113
-- chroot /host bash -c \
123-
"nsenter -n -t \$(runc state \$(crictl pods --namespace "$namespace" --name "$pod" -q) | jq .pid) $command")
114+
"nsenter -n -t \$(runc state \$(crictl ps --pod \$(crictl pods --namespace "$namespace" --name "$pod" -q) -q) | jq .pid) $command")
124115
echo "INFO: $ans"
125116

126117
# since we cannot trust the return code from the debug container, we have to add logic to consider

‎debug-scripts/network-tools‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ if [[ "$network_plugin" == "OVNKubernetes" ]] ; then
2020
# run scripts
2121
ovn_pod_to_pod_connectivity "$global_namespace"/"$client" "$global_namespace"/"$server"
2222
ovn_pod_to_svc_connectivity "$global_namespace"/"$client" "$global_namespace"/"$server"
23-
ovn_ipsec_connectivity "$global_namespace"
23+
ovn_ipsec_connectivity
2424
elif [[ "$network_plugin" == "OpenShiftSDN" ]] ; then
2525
# run scripts
2626
sdn_pod_to_pod_connectivity "$global_namespace"/"$client" "$global_namespace"/"$server"
2727
sdn_pod_to_svc_connectivity "$global_namespace"/"$client" "$global_namespace"/"$server"
2828
sdn_cluster_and_node_info
29-
# sdn_node_connectivity
29+
sdn_node_connectivity
3030
else
3131
echo "Unable to debug cluster networking. Only OpenShiftSDN and OVNKubernetes plugins are supported"
3232
fi

‎debug-scripts/ovn_ipsec_connectivity‎

Lines changed: 11 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -26,25 +26,6 @@ do_ovn_ipsec_encryption_check () {
2626
DATE=$(date +"%Y-%m-%d")
2727
PCAP_FILENAME="ipsec-test-${DATE}.pcap"
2828

29-
# TODO check with oc get network.operator.openshift.io/cluster -o=jsonpath='{.items[*].spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig}'
30-
# once tests can be run with real cluster
31-
if [ -z "$IPSEC_PODS" ]; then #|| [ "$IPSEC_ENABLED" ]; then
32-
echo "No ovn-ipsec pods exist, tunnel traffic will be unencrypted"
33-
return 0
34-
else
35-
echo "ovn-ipsec is enabled, tunnel traffic should be encryted"
36-
return 1
37-
fi
38-
39-
}
40-
41-
do_ovn_ipsec_encryption_check () {
42-
WORKER_NODES=($(get_worker_nodes_linux))
43-
DATE=$(date +"%Y-%m-%d")
44-
PCAP_FILENAME="ipsec-test-${DATE}.pcap"
45-
46-
# TODO check with oc get network.operator.openshift.io/cluster -o=jsonpath='{.items[*].spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig}'
47-
# once tests can be run with real cluster
4829
if ! [ check_ovn_ipsec_enabled ]; then
4930
exit 0
5031
fi
@@ -55,6 +36,9 @@ do_ovn_ipsec_encryption_check () {
5536

5637
create_pod_on_node $client_debug_pod "${WORKER_NODES[0]}"
5738
create_pod_on_node $server_debug_pod "${WORKER_NODES[1]}"
39+
40+
global_namespace=$(oc get pod $client_debug_pod -o jsonpath={.metadata.namespace})
41+
5842
create_host_network_pod_on_node $sniffer_debug_pod "${WORKER_NODES[1]}" "$global_namespace"
5943

6044
server_debug_pod_ip=$(get_pod_ip "$global_namespace" "$server_debug_pod")
@@ -66,14 +50,13 @@ do_ovn_ipsec_encryption_check () {
6650
interface=${interface//$'\n'/}
6751
echo "INFO: Ethernet Interface name is: ${interface}"
6852

69-
echo "INFO: packet sniffing command is: tcpdump -i ${interface} -vv -c 2 -w ${PCAP_FILENAME} src \
70-
$(kubectl get node "${WORKER_NODES[0]}" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}') \
71-
&& dst $(kubectl get node "${WORKER_NODES[1]}" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')"
53+
tcpdump_expression="src $(kubectl get node "${WORKER_NODES[0]}" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}') \
54+
and dst $(kubectl get node "${WORKER_NODES[1]}" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')"
55+
tcpdump_command="tcpdump -i ${interface} -vv -c 2 -w ${PCAP_FILENAME} ${tcpdump_expression}"
7256

57+
echo "INFO: packet sniffing command is: ${tcpdump_command}"
7358
#start sniffer in host networked pod, but only look for packets going over the tunnel from node1 -> node2
74-
75-
oc rsh -n "$global_namespace" ${sniffer_debug_pod} timeout 30s tcpdump -i ${interface} -vv -c 2 -w "${PCAP_FILENAME}" \
76-
src "$(kubectl get node "${WORKER_NODES[0]}" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')" and dst "$(kubectl get node "${WORKER_NODES[1]}" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')" > /dev/null 2>&1 \
59+
oc rsh -n "$global_namespace" ${sniffer_debug_pod} timeout 30s ${tcpdump_command} > /dev/null 2>&1 \
7760
& PID=$!
7861

7962
echo "INFO: pinging server from client pod: oc rsh ${client_debug_pod} ping ${server_debug_pod_ip} -c 5 -W 2"
@@ -84,24 +67,22 @@ do_ovn_ipsec_encryption_check () {
8467

8568
oc cp -n "$global_namespace" --loglevel 1 ${sniffer_debug_pod}:/${PCAP_FILENAME} ./${logdir}/${PCAP_FILENAME} > /dev/null 2>&1 && PIDS+=($!)
8669

87-
if [ -f "${PCAP_FILENAME}" ]; then
88-
if tshark -r "${PCAP_FILENAME}" -T fields -e frame.protocols | grep -q "esp"; then
70+
if [ -f "./${logdir}/${PCAP_FILENAME}" ]; then
71+
if tshark -r "./${logdir}/${PCAP_FILENAME}" -T fields -e frame.protocols | grep -q "esp"; then
8972
echo " "
9073
echo "INFO:Tunnel traffic is encrypted with ovn-ipsec!"
9174
echo " "
9275
else
9376
echo " "
94-
echo "INFO:Tunnel traffic is not encrypted, check pcap: ${PCAP_FILENAME} for further details"
77+
echo "INFO:Tunnel traffic is not encrypted, check pcap: "./${logdir}/${PCAP_FILENAME}" for further details"
9578
echo " "
9679
fi
9780
else
9881
echo "INFO:tcpdump error ${PCAP_FILENAME} wasn't written"
9982
fi
10083

10184
## cleanup resources
102-
10385
oc delete pod $server_debug_pod $client_debug_pod $sniffer_debug_pod
104-
10586
}
10687

10788
help()
@@ -135,6 +116,4 @@ while getopts ":h" option; do
135116
esac
136117
done
137118

138-
global_namespace="${1}"
139-
140119
main

‎debug-scripts/sdn_node_connectivity‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ do_sdn_node_connectivity_check() {
2626
for node in $(oc get hostsubnet -o name); do
2727
local success=overlay
2828
if ! ping $(sdn_overlay_ip "${node}") -w 2 -W 1 2>&1 >/dev/null ; then
29-
sucess=underlay
29+
success=underlay
3030
if ! ping $(sdn_underlay_ip "${node}") -w 2 -W 1 2>&1 >/dev/null ; then
3131
success=no
3232
fi

0 commit comments

Comments
 (0)