Support F5 partition path #13391

rajatchopra · 2017-03-14T21:49:24Z

F5 router partition path changes:
o Use fully qualified names so that there is no defaulting to /Common
and need to have all the referenced objects in the same partition,
otherwise F5 has reference errors across partitions.
o Fix policy partition path + rework and ensure we check the vserver
which is inside the partition we are configured in.
o Comment re: delete errors.
o Bug fixes.
o F5 unit test changes for supporting partition paths.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1245243

o Use fully qualified names so that there is no defaulting to /Common and need to have all the referenced objects in the same partition, otherwise F5 has reference errors across partitions. o Fix policy partition path + rework and ensure we check the vserver which is inside the partition we are configured in. o Comment re: delete errors. o Bug fixes. o F5 unit test changes for supporting partition paths.

rajatchopra · 2017-03-14T22:55:01Z

[test]

rajatchopra · 2017-03-15T00:15:48Z

@knobunc @eparis FYI

eparis · 2017-03-15T00:43:01Z

[test] #12007

rajatchopra · 2017-03-31T06:44:27Z

Basic testing is successful
@openshift/networking Review needed

knobunc

LGTM

pravisankar

F5 integration tests need to be fixed.
Added some comments, Rest of the changes looks good.

pravisankar · 2017-03-31T20:45:19Z

pkg/router/f5/f5.go

@@ -532,7 +576,7 @@ func (f5 *f5LTM) ensureVxLANTunnel() error {
 		AddressSource:         "from-user",
 		Floating:              "disabled",
 		InheritedTrafficGroup: "false",
-		TrafficGroup:          path.Join(f5.partitionPath, "traffic-group-local-only"),
+		TrafficGroup:          path.Join("/Common", "traffic-group-local-only"), // Traffic group is global
 		Unit:                  0,
 		Vlan:                  path.Join(f5.partitionPath, F5VxLANTunnelName),


Vlan is local per partition or is it global similar to traffic-group?

pravisankar · 2017-03-31T20:46:28Z

pkg/router/f5/f5.go

@@ -727,8 +781,9 @@ func (f5 *f5LTM) ensureIRuleExists(iRuleName, iRule string) error {
 	iRulesUrl := fmt.Sprintf("https://%s/mgmt/tm/ltm/rule", f5.host)

 	iRulePayload := f5IRule{
-		Name: iRuleName,
-		Code: iRule,
+		Name:      iRuleName,


iRuleName or f5.iControlUriResourceId(iRuleName)?

will confirm with F5 team, but this seems to work so far because the Partition field is also part of the payload

pravisankar · 2017-03-31T20:48:00Z

pkg/router/f5/f5.go

-		Monitor: "min 1 of /Common/http /Common/https",
-		Name:    poolname,
+		Mode:      "round-robin",
+		Monitor:   "min 1 of /Common/http /Common/https",


fmt.Sprintf("min 1 of /%s/http /%s/https", f5.partionPath, f5.partionPath)?

https://github.com/rajatchopra/origin/blob/98d640de0b5272c09badaa7cc1a46677b6e96df6/pkg/router/f5/f5.go#L1029
https://github.com/rajatchopra/origin/blob/98d640de0b5272c09badaa7cc1a46677b6e96df6/pkg/router/f5/f5.go#L1057
can use encodeiControlUriPathComponent()

Cannot be sure of http/https monitors being present in the given partition. It is safe to re-use the common monitor just as we re-use TrafficGroup. Good point though, in ideal case we would want this to exist and probably we can write code to ensure the monitors' presence.
Will add a comment about this.

Agree with @rajatchopra, though long term it should be (as @Miciah hinted ) a configurable option, given that the default LTM traffic monitors don't work properly for the atomic registry console and the workaround right now is to manually change the traffic monitor used for the pool for the registry console (given that /Common/http and /Common/https are read-only objects in LTM)

pravisankar · 2017-03-31T21:04:13Z

pkg/router/f5/f5.go

@@ -1187,7 +1243,7 @@ func (f5 *f5LTM) getRoutes(policyname string) (map[string]bool, error) {
 	}

 	url := fmt.Sprintf("https://%s/mgmt/tm/ltm/policy/%s/rules",
-		f5.host, policyname)
+		f5.host, f5.iControlUriResourceId(policyname))


https://github.com/openshift/origin/pull/13391/files#diff-997442d3bc5e2bf387c3840016b5c335R1261

If there are two partitions with same policy name, then f5.routes[policyname] will overwrite the former. Do we expect this case? If yes, then f5.routes[f5.iControlUriResourceId(policyname)] = routes

Each instance of the controller pod will run with only one given partition. All internal data structures need not bother about multiple partitions.

ramr · 2017-04-03T21:52:46Z

@rajatchopra lemme know if you want another set of eyes to take a look. These days I tend to shy away for PRs that have more than a few lines of change!! ;^)

openshift-bot · 2017-04-03T22:29:31Z

Evaluated for origin test up to 6ee3a7e

rajatchopra

Thanks for the feedback @pravisankar
I have fixed the tests. Will add the comment and hopefully we can get this in. Thanks.

rajatchopra · 2017-04-03T23:04:27Z

pkg/router/f5/f5.go

@@ -727,8 +781,9 @@ func (f5 *f5LTM) ensureIRuleExists(iRuleName, iRule string) error {
 	iRulesUrl := fmt.Sprintf("https://%s/mgmt/tm/ltm/rule", f5.host)

 	iRulePayload := f5IRule{
-		Name: iRuleName,
-		Code: iRule,
+		Name:      iRuleName,


will confirm with F5 team, but this seems to work so far because the Partition field is also part of the payload

rajatchopra · 2017-04-03T23:06:29Z

pkg/router/f5/f5.go

-		Monitor: "min 1 of /Common/http /Common/https",
-		Name:    poolname,
+		Mode:      "round-robin",
+		Monitor:   "min 1 of /Common/http /Common/https",


Cannot be sure of http/https monitors being present in the given partition. It is safe to re-use the common monitor just as we re-use TrafficGroup. Good point though, in ideal case we would want this to exist and probably we can write code to ensure the monitors' presence.
Will add a comment about this.

rajatchopra · 2017-04-03T23:07:25Z

pkg/router/f5/f5.go

@@ -1187,7 +1243,7 @@ func (f5 *f5LTM) getRoutes(policyname string) (map[string]bool, error) {
 	}

 	url := fmt.Sprintf("https://%s/mgmt/tm/ltm/policy/%s/rules",
-		f5.host, policyname)
+		f5.host, f5.iControlUriResourceId(policyname))


Each instance of the controller pod will run with only one given partition. All internal data structures need not bother about multiple partitions.

openshift-bot · 2017-04-03T23:40:17Z

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pull_request_origin/539/) (Base Commit: 3b82ca6)

rajatchopra · 2017-04-04T03:09:06Z

@knobunc I think this is ready for merge

rajatchopra · 2017-04-04T16:52:20Z

lemme know if you want another set of eyes to take a look

@ramr Thanks. I am saving this offer for a real rainy day :)

knobunc · 2017-04-04T17:21:14Z

[merge]

rajatchopra · 2017-04-04T23:50:13Z

flake #13606
re [merge]

openshift-bot · 2017-04-04T23:53:21Z

Evaluated for origin merge up to 6ee3a7e

openshift-bot · 2017-04-05T00:05:28Z

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_request_origin/247/) (Base Commit: b39b0ed) (Image: devenv-rhel7_6117)

rajatchopra force-pushed the f5partition branch from 24ed354 to de4ca18 Compare March 14, 2017 22:54

rajatchopra force-pushed the f5partition branch from f11c4ee to 324ffd9 Compare March 31, 2017 17:17

policy urls should support partitions

98d640d

rajatchopra force-pushed the f5partition branch from 324ffd9 to 98d640d Compare March 31, 2017 17:20

knobunc approved these changes Mar 31, 2017

View reviewed changes

pravisankar reviewed Mar 31, 2017

View reviewed changes

Fix go tests; policy requests now include the partition paths

6ee3a7e

rajatchopra commented Apr 3, 2017

View reviewed changes

openshift-bot merged commit 83a6089 into openshift:master Apr 5, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support F5 partition path #13391

Support F5 partition path #13391

rajatchopra commented Mar 14, 2017

rajatchopra commented Mar 14, 2017

rajatchopra commented Mar 15, 2017

eparis commented Mar 15, 2017

rajatchopra commented Mar 31, 2017

knobunc left a comment

pravisankar left a comment •

edited

Loading

pravisankar Mar 31, 2017

pravisankar Mar 31, 2017

rajatchopra Apr 3, 2017

pravisankar Mar 31, 2017

pravisankar Mar 31, 2017

rajatchopra Apr 3, 2017

cpganderton Apr 4, 2017 •

edited

Loading

pravisankar Mar 31, 2017

rajatchopra Apr 3, 2017

ramr commented Apr 3, 2017

openshift-bot commented Apr 3, 2017

rajatchopra left a comment

rajatchopra Apr 3, 2017

rajatchopra Apr 3, 2017

rajatchopra Apr 3, 2017

openshift-bot commented Apr 3, 2017

rajatchopra commented Apr 4, 2017

rajatchopra commented Apr 4, 2017

knobunc commented Apr 4, 2017

rajatchopra commented Apr 4, 2017

openshift-bot commented Apr 4, 2017

openshift-bot commented Apr 5, 2017 •

edited

Loading

Support F5 partition path #13391

Support F5 partition path #13391

Conversation

rajatchopra commented Mar 14, 2017

rajatchopra commented Mar 14, 2017

rajatchopra commented Mar 15, 2017

eparis commented Mar 15, 2017

rajatchopra commented Mar 31, 2017

knobunc left a comment

Choose a reason for hiding this comment

pravisankar left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cpganderton Apr 4, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ramr commented Apr 3, 2017

openshift-bot commented Apr 3, 2017

rajatchopra left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-bot commented Apr 3, 2017

rajatchopra commented Apr 4, 2017

rajatchopra commented Apr 4, 2017

knobunc commented Apr 4, 2017

rajatchopra commented Apr 4, 2017

openshift-bot commented Apr 4, 2017

openshift-bot commented Apr 5, 2017 • edited Loading

pravisankar left a comment •

edited

Loading

cpganderton Apr 4, 2017 •

edited

Loading

openshift-bot commented Apr 5, 2017 •

edited

Loading