Update and Activate `ovn_ipsec_connectivity` #37

astoycos · 2021-02-15T17:37:38Z

Activate IPSEC test, and convert test to use built in functions described in the common script

When run it will check if node to node traffic in an OVN-K cluster is encrypted with IPSEC

Output will resemble the following

[astoycos@localhost debug-scripts]$ ./network-tools 
INFO: Cluster is using OVNKubernetes network plugin
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4 labeled
INFO: Scheduling network-tools-debug-pod-5gqot on ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4
pod/network-tools-debug-pod-5gqot created
pod/network-tools-debug-pod-5gqot condition met
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4 labeled
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4 labeled
INFO: Scheduling network-tools-debug-svc-ipz62 on ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4
pod/network-tools-debug-svc-ipz62 created
pod/network-tools-debug-svc-ipz62 condition met
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4 labeled
INFO: Creating a ClusterIP service: network-tools-debug-svc-ipz62
service/network-tools-debug-svc-ipz62 exposed
IPSEC is enabled 
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4 labeled
INFO: Scheduling client-debug-3qnme on ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4
pod/client-debug-3qnme created
pod/client-debug-3qnme condition met
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-b-fmrh4 labeled
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694 labeled
INFO: Scheduling server-debug-0m5ei on ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694
pod/server-debug-0m5ei created
pod/server-debug-0m5ei condition met
node/ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694 labeled
INFO: Scheduling ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694-debug on ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694
pod/ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694-debug condition met
INFO: Get Ethernet Interface Name
INFO: Ethernet Interface name is: ens4
INFO: packet sniffing command is: tcpdump -i ens4 -vv -c 2 -w ipsec-test-2021-02-15.pcap src     10.0.32.4     && dst 10.0.32.2
INFO: pinging server from client pod: oc rsh client-debug-3qnme ping 10.128.6.64 -c 5 -W 2
 
INFO:Tunnel traffic is encrypted with ovn-ipsec!
 
pod "server-debug-0m5ei" deleted
pod "client-debug-3qnme" deleted
pod "ci-ln-4yjcsz2-f76d1-75gv8-worker-c-q9694-debug" deleted

This PR also adds some fixes to common functions (see commit messages for more detail)

TODO: The script generates a PCAP which should prove that the traffic is encrypted... This file is copied to the network-tools image and should be accessible to the user at some point

astoycos · 2021-02-16T19:32:34Z

/retest

tssurya

Thanks for the PR Andrew! couple of questions inline.

debug-scripts/common

tssurya · 2021-02-19T12:54:06Z

debug-scripts/ovn_ipsec_connectivity

+    # TODO check with oc get network.operator.openshift.io/cluster -o=jsonpath='{.items[*].spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig}'
+    # once tests can be run with real cluster


we can't run it using cluster-bot now ?

not yet unfortunately I think Mark has some work in the pipeline to be able to do so though

tssurya · 2021-02-19T12:56:14Z

debug-scripts/ovn_ipsec_connectivity

 }

+help()


this func has to be changed in accordance to this script.

Ack sorry missed that

tssurya · 2021-02-19T12:57:01Z

debug-scripts/common

@@ -175,3 +199,12 @@ create_host_network_pod_on_node () {
    sleep 2
    oc wait -n "$NAMESPACE" --for=condition=Ready pod/"$POD_NAME" --timeout=3m
 }
+
+format_sdout () { 


nit: stdout

Yep I actually didn't mean to have the color formatting in this PR... Sorry about that!

tssurya

/lgtm

just a few nits, wouldn't block merge. As noted, we still need to do some improvements to the ipsec script once we have a better way to spawn an ipsec cluster on openshift.

tssurya · 2021-03-02T15:49:16Z

debug-scripts/common

@@ -174,4 +191,4 @@ create_host_network_pod_on_node () {
    # wait till pod is running
    sleep 2
    oc wait -n "$NAMESPACE" --for=condition=Ready pod/"$POD_NAME" --timeout=3m
-}
+}


woops, we actually need the newline.

tssurya · 2021-03-02T15:49:29Z

debug-scripts/ovn_ipsec_connectivity

+
+global_namespace="${1}"
+
+main


tssurya · 2021-03-03T03:17:49Z

/assign @rcarrillocruz

Cleanup the info logging Make the tcpdump command run in a dedicated host-networked container copy pcap capture back to the network-tools container TODO: Copy this file out to the local machine Fix some empty fields erros In some of these functions they didn't seem to work if the namespace or other parameters were not specified This commit just adds some error checking to those functions Signed-off-by: Andrew Stoycos <astoycos@redhat.com>

Activiates this test for the network-tools image Script will check for ipsec enablement internally and only run if so Signed-off-by: Andrew Stoycos <astoycos@redhat.com>

openshift-ci-robot · 2021-04-05T14:00:57Z

New changes are detected. LGTM label has been removed.

rcarrillocruz · 2021-04-05T14:04:51Z

/approve

openshift-ci-robot · 2021-04-05T14:05:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: astoycos, rcarrillocruz, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rcarrillocruz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

astoycos · 2021-04-05T18:11:55Z

/retest

astoycos · 2021-04-05T19:47:13Z

/retest

astoycos · 2021-04-06T12:56:25Z

/retest

tssurya · 2021-05-07T16:46:45Z

/lgtm

openshift-ci · 2021-05-07T16:46:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: astoycos, rcarrillocruz, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rcarrillocruz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-05-08T02:23:03Z

/retest

Please review the full test history for this PR and help us cut down flakes.

Update and Activate `ovn_ipsec_connectivity`

openshift-ci-robot requested review from pliurh and zshi-redhat February 15, 2021 17:37

tssurya reviewed Feb 19, 2021

View reviewed changes

astoycos force-pushed the update-ipsec-check branch from 4b0fff5 to 720912a Compare February 23, 2021 22:24

tssurya reviewed Mar 2, 2021

View reviewed changes

openshift-ci-robot assigned tssurya Mar 2, 2021

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2021

openshift-ci-robot assigned rcarrillocruz Mar 3, 2021

astoycos added 2 commits April 5, 2021 09:59

Activate the ipsec connectivity test

8f259c0

Activiates this test for the network-tools image Script will check for ipsec enablement internally and only run if so Signed-off-by: Andrew Stoycos <astoycos@redhat.com>

astoycos force-pushed the update-ipsec-check branch from 720912a to 8f259c0 Compare April 5, 2021 14:00

openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Apr 5, 2021

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 5, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 7, 2021

openshift-merge-robot merged commit c57d9f8 into openshift:master May 8, 2021

tssurya pushed a commit to tssurya/network-tools that referenced this pull request Jun 7, 2021

Merge pull request openshift#37 from astoycos/update-ipsec-check

f064db9

Update and Activate `ovn_ipsec_connectivity`

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update and Activate `ovn_ipsec_connectivity` #37

Update and Activate `ovn_ipsec_connectivity` #37

astoycos commented Feb 15, 2021

astoycos commented Feb 16, 2021

tssurya left a comment

tssurya Feb 19, 2021

astoycos Feb 23, 2021

tssurya Feb 19, 2021

astoycos Feb 23, 2021

tssurya Feb 19, 2021

astoycos Feb 23, 2021

tssurya left a comment

tssurya Mar 2, 2021

tssurya Mar 2, 2021

tssurya commented Mar 3, 2021

openshift-ci-robot commented Apr 5, 2021

rcarrillocruz commented Apr 5, 2021

openshift-ci-robot commented Apr 5, 2021

astoycos commented Apr 5, 2021

astoycos commented Apr 5, 2021

astoycos commented Apr 6, 2021

tssurya commented May 7, 2021

openshift-ci bot commented May 7, 2021

openshift-bot commented May 8, 2021

		# TODO check with oc get network.operator.openshift.io/cluster -o=jsonpath='{.items[*].spec.defaultNetwork.ovnKubernetesConfig.ipsecConfig}'
		# once tests can be run with real cluster

		}

		help()


		global_namespace="${1}"

		main

Update and Activate ovn_ipsec_connectivity #37

Update and Activate ovn_ipsec_connectivity #37

Conversation

astoycos commented Feb 15, 2021

astoycos commented Feb 16, 2021

tssurya left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tssurya left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tssurya commented Mar 3, 2021

openshift-ci-robot commented Apr 5, 2021

rcarrillocruz commented Apr 5, 2021

openshift-ci-robot commented Apr 5, 2021

astoycos commented Apr 5, 2021

astoycos commented Apr 5, 2021

astoycos commented Apr 6, 2021

tssurya commented May 7, 2021

openshift-ci bot commented May 7, 2021

openshift-bot commented May 8, 2021

Update and Activate `ovn_ipsec_connectivity` #37

Update and Activate `ovn_ipsec_connectivity` #37