OSDOCS-2174: subtask: remove IP failover #35436
Conversation
|
✔️ Deploy Preview for osdocs ready! 🔨 Explore the source changes: f2a00f7 🔍 Inspect the deploy log: https://app.netlify.com/sites/osdocs/deploys/61252a632c0ebf00089d6adc 😎 Browse the preview: https://deploy-preview-35436--osdocs.netlify.app |
openshift-ci
bot
added
the
size/L
|
PTAL and let me know what I need to change! /assign @msherif1234 |
|
@bmcelvee, can you recommend an SME from network edge to peek? As we exchanged briefly in Slack, I figured it made the most sense to put this new procedure on the same page as everything else for IP failover. |
|
@rfredette would you mind reviewing this PR, please? Thanks! |
The page already has mention of an IP tables rule. Unless someone feels very strongly, my preference is to be as clear as possible that the job runs to reverse that rule. The rule is mentioned in |
rfredette
left a comment
rfredette
left a comment
There was a problem hiding this comment.
lgtm; I had one nit-pick, but even if it's not addressed I think this looks good.
modules/nw-ipfailover-remove.adoc
Outdated
There was a problem hiding this comment.
Is it necessary to manually remove the security context constraints? I'm not super knowledgeable in this area, but I'd think sccs would be cleaned up when deleting the service account in the next step.
There was a problem hiding this comment.
@rfredette, I think you are correct, or at least the key is that the doc specifies spec.serviceAccountName: ipfailover and so if the service account is deleted, then customers would need to play by some other rules than what is documented.
FWIW:
$ oc adm policy scc-review -z ipfailover -f ipfailover.yaml
RESOURCE SERVICE ACCOUNT ALLOWED BY
Deployment/ipfailover-keepalived ipfailover privileged
$ oc delete sa ipfailover
serviceaccount "ipfailover" deleted
$ oc adm policy scc-review -f ipfailover.yaml
error: unable to compute Pod Security Policy Review for "ipfailover-keepalived": unable to retrieve ServiceAccount ipfailover: serviceaccount "ipfailover" not found
$ oc adm policy scc-review -z ipfailover -f ipfailover.yaml
error: unable to compute Pod Security Policy Review for "ipfailover-keepalived": unable to retrieve ServiceAccount ipfailover: serviceaccount "ipfailover" not found
Thank you.
modules/nw-ipfailover-remove.adoc
Outdated
adellape
left a comment
adellape
left a comment
There was a problem hiding this comment.
Just the one comment, but otherwise LGTM.
modules/nw-ipfailover-remove.adoc
Outdated
There was a problem hiding this comment.
Use colon before substeps (throughout).
MetalLB and IP failover (keepalived) are incompatible. Technical info for this commit originated in NE-572. * Feedback from Ryan F. * Move step to locate config maps to before the step that deletes the pods. * Use `iptables` to match existing formatting. * Feedback from Mohamed and Arti. * Review from Alex. End instructional text that introduces substeps with a colon unless another sentence intervenes.
mikemckiernan
added
the
peer-review-done
|
/cherrypick enterprise-4.9 |
|
@mikemckiernan: new pull request created: #35769 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
8 participants
MetalLB and IP failover (keepalived) are
incompatible. Technical info for this
commit originated in NE-572.
Preview the Removing IP failover topic.