Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPBUGSM-45393: Bug 2078691: [Downstream Merge] 22-07-2022 #1210

Merged
merged 15 commits into from Jul 23, 2022
Merged

OCPBUGSM-45393: Bug 2078691: [Downstream Merge] 22-07-2022 #1210

merged 15 commits into from Jul 23, 2022

Conversation

tssurya
Copy link
Contributor

@tssurya tssurya commented Jul 22, 2022 •
edited

zshi-redhat and others added 15 commits July 5, 2022 21:27
@zshi-redhat
Build all ovnk binaries with cgo disabled
4bc5134 
remove runtime dependencies for c libraries

Signed-off-by: Zenghui Shi <zshi@redhat.com>
@tssurya
Change rp_filter value for ovn-k8s-mp0
944b5c2 
Currently the default value for all interfaces is 0 while
rp_filter for "all" is set to 1.

rp_filter - INTEGER
	0 - No source validation.
	1 - Strict mode as defined in RFC3704 Strict Reverse Path
	    Each incoming packet is tested against the FIB and if the interface
	    is not the best reverse path the packet check will fail.
	    By default failed packets are discarded.
	2 - Loose mode as defined in RFC3704 Loose Reverse Path
	    Each incoming packet's source address is also tested against the FIB
	    and if the source address is not reachable via any interface
	    the packet check will fail.

	Current recommended practice in RFC3704 is to enable strict mode
	to prevent IP spoofing from DDos attacks. If using asymmetric routing
	or other complicated routing, then loose mode is recommended.

	The max value from conf/{all,interface}/rp_filter is used
	when doing source validation on the {interface}.

As per the definitions to avail other FIB table based routing
we should set rp_filter for ovn-k8s-mp0 to 2 to support ITP=local
feature. Security wise we are still ok since we are enabling this only
on ovnk interface mp0 and not on any other interface.

NOTE: Pkt from host goes into ovn via mp0 destined for clusterIP
and it goes in via the new routing table 7 that was added. Return
packet with srcIP=clusterIP comes out via mp0 and default routing
table says all clusterIP traffic should go to br-ex and this is why
reverse path filter check fails since onward packet went in via mp0.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
@trozet
Merge pull request #3006 from tssurya/fix-rp-filtering
69d8a99 
Change rp_filter value for ovn-k8s-mp0
@dceara
e2e: Fix checking of mac entries embedded in conntrack labels.
bdbf2bc 
Closes #3078

Signed-off-by: Dumitru Ceara <dceara@redhat.com>
@dcbw
Merge pull request #3079 from dceara/improve-ecmp-symmetric-reply-test
3007ccb 
e2e: Fix checking of mac entries embedded in conntrack labels.
@trozet
Merge pull request #3061 from zshi-redhat/cgo
d088113 
Build all ovnk binaries with cgo disabled
@tssurya
iterateRetryResources: Lock the entry in the loop
f995271 
We weren't locking individual entries while looping through
them, this was causing races when same entry was changed or
accessed elsewhere in the code.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
Closes: #3080
@msherif1234
EgressIP node create err followed by update in < 30s
cab145f 
If EgressIP node create failed while creating default
NoRoute policy then an update event happens before
objRetry period "30sec" there is no logic to retry
recreating this policy.

Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>
@numansiddique
fedora Dockerfile : Update OVN to 22.06.
4267ff8 
Signed-off-by: Numan Siddique <numans@ovn.org>
@tssurya
syncNetworkPolicies: Remove ACLs from PGs before deleting
4d446ba 
We weren't removing reference of ACL from PG before deleting
it. Unfortuntely unit tests don't catch this.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
@trozet
Merge pull request #3081 from tssurya/fix-locking-localretries
94f3603 
iterateRetryResources: Lock the entry in the loop
@trozet
Merge pull request #3082 from numansiddique/ovn_22.06
190263e 
fedora Dockerfile : Update OVN to 22.06.
@trozet
Merge pull request #3076 from tssurya/remove-acl-from-pg
1b79d70 
syncNetworkPolicies: Remove ACLs from PGs before deleting
@trozet
Merge pull request #3073 from msherif1234/egip_retry_fix
da607b4 
EgressIP node handle create errs followed by update in < 30s
@tssurya
Merge remote-tracking branch 'ovnorg/master' into merge-22-07-2022
2e09d3b
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 22, 2022

@tssurya: GitHub didn't allow me to request PR reviews from the following users: has, a, merge, tagging, because, one, numansiddique, in, the, each.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @zshi-redhat @dceara @msherif1234 @numansiddique tagging because each one has a commit in the merge
/assign @trozet for approve
/assign @dcbw for approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tssurya tssurya changed the title [Downstream Merge] 22-07-2022 Bug 2078691: [Downstream Merge] 22-07-2022 Jul 22, 2022
@openshift-ci openshift-ci bot added bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Jul 22, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 22, 2022

@tssurya: This pull request references Bugzilla bug 2078691, which is valid. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.12.0) matches configured target release for branch (4.12.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @huiran0826

In response to this:

Bug 2078691: [Downstream Merge] 22-07-2022

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot requested a review from huiran0826 July 22, 2022 10:37
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 22, 2022

@tssurya: This pull request references Bugzilla bug 2078691, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.12.0) matches configured target release for branch (4.12.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @huiran0826

In response to this:

Bug 2078691: [Downstream Merge] 22-07-2022

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

1 similar comment
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 22, 2022

@tssurya: This pull request references Bugzilla bug 2078691, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.12.0) matches configured target release for branch (4.12.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @huiran0826

In response to this:

Bug 2078691: [Downstream Merge] 22-07-2022

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tssurya tssurya changed the title Bug 2078691: [Downstream Merge] 22-07-2022 OCPBUGSM-45393: Bug 2078691: [Downstream Merge] 22-07-2022 Jul 22, 2022
@tssurya
Copy link
Contributor Author

tssurya commented Jul 22, 2022

/refresh bugzilla

@trozet
Copy link
Contributor

trozet commented Jul 22, 2022

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 22, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 22, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: trozet, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 22, 2022
@dcbw
Copy link
Member

dcbw commented Jul 22, 2022

/retest

level=error msg=Error: error creating EC2 NAT Gateway: InvalidElasticIpID.NotFound: The elasticIp ID 'eipalloc-0858731243416eb5f' does not exist
level=error msg=	status code: 400, request id: c71beae7-b49f-4a90-9335-e10d873e89ee
level=error
level=error msg=  with module.vpc.aws_nat_gateway.nat_gw[0],
level=error msg=  on vpc/vpc-public.tf line 85, in resource "aws_nat_gateway" "nat_gw":
level=error msg=  85: resource "aws_nat_gateway" "nat_gw" {

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 2 against base HEAD 4400a19 and 8 for PR HEAD 2e09d3b in total

@anuragthehatter
Copy link

/label qe-approved
QE regression passed on associated cases https://mastern-jenkins-csb-openshift-qe.apps.ocp-c1.prod.psi.redhat.com/job/ocp-common/job/Runner/524494/console

@anuragthehatter
Copy link

/abel qe-approved

@anuragthehatter
Copy link

/label qe-approved

@openshift-ci openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Jul 22, 2022
@anuragthehatter
Copy link

Ahh there are couple of more bugs as I noted in description. Sorry for that

/label qe-approved cancel

@anuragthehatter
Copy link

anuragthehatter commented Jul 22, 2022 •
edited

Ahh there are couple of more bugs as I noted in description. Sorry for that

/label qe-approved cancel

@dcbw @abhat I need your help to take off qe-approved label from it :)

@abhat
Copy link
Contributor

abhat commented Jul 22, 2022

/remove qe-approved

@tssurya
Copy link
Contributor Author

tssurya commented Jul 22, 2022

/test e2e-metal-ipi-ovn-dualstack

@tssurya
Copy link
Contributor Author

tssurya commented Jul 22, 2022

again the metal dualstack job doesn't look promosing: https://prow.ci.openshift.org/job-history/gs/origin-ci-test/pr-logs/directory/pull-ci-openshift-ovn-kubernetes-master-e2e-metal-ipi-ovn-dualstack

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 1 against base HEAD 4400a19 and 7 for PR HEAD 2e09d3b in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 4400a19 and 6 for PR HEAD 2e09d3b in total

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 23, 2022

@tssurya: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-e2e-gcp-ovn 2e09d3b link false /test okd-e2e-gcp-ovn
ci/prow/e2e-hypershift 2e09d3b link false /test e2e-hypershift

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-merge-robot openshift-merge-robot merged commit dc3f15b into openshift:master Jul 23, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 23, 2022 •
edited

@tssurya: All pull requests linked via external trackers have merged:

Bugzilla bug 2078691 has been moved to the MODIFIED state.

In response to this:

OCPBUGSM-45393: Bug 2078691: [Downstream Merge] 22-07-2022

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@msherif1234 msherif1234 Awaiting requested review from msherif1234

@zshi-redhat zshi-redhat Awaiting requested review from zshi-redhat

@dceara dceara Awaiting requested review from dceara

@huiran0826 huiran0826 Awaiting requested review from huiran0826

Assignees

@trozet trozet

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged. qe-approved Signifies that QE has signed off on this PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet