From a09d0c14021119f90d970e43e3bc0f35f8e42e56 Mon Sep 17 00:00:00 2001 From: zhaozhanqi Date: Wed, 1 Apr 2026 22:29:25 -0400 Subject: [PATCH 1/2] ovn-k: grant routeadvertisements CRUD to control-plane SA in managed routing mode When no-overlay transport is configured with managed routing (NoOverlayManagedEnabled), the ovn-kubernetes-control-plane service account runs the managed BGP controller which needs to create, delete, patch and update RouteAdvertisements CRs. The existing OVN_ROUTE_ADVERTISEMENTS_ENABLE block only grants list/get/watch, causing the cluster manager to fail on startup with a forbidden error. Signed-off-by: zhaozhanqi --- .../common/004-rbac-control-plane.yaml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/bindata/network/ovn-kubernetes/common/004-rbac-control-plane.yaml b/bindata/network/ovn-kubernetes/common/004-rbac-control-plane.yaml index e100ac3130..8c7feb9206 100644 --- a/bindata/network/ovn-kubernetes/common/004-rbac-control-plane.yaml +++ b/bindata/network/ovn-kubernetes/common/004-rbac-control-plane.yaml @@ -243,7 +243,7 @@ rules: verbs: - patch - update -- apiGroups: +- apiGroups: - frrk8s.metallb.io resources: - frrconfigurations @@ -256,6 +256,17 @@ rules: - update - patch {{- end}} +{{- if .NoOverlayManagedEnabled }} +- apiGroups: + - k8s.ovn.org + resources: + - routeadvertisements + verbs: + - create + - delete + - patch + - update +{{- end}} {{- if .OVN_EVPN_ENABLE }} - apiGroups: - k8s.ovn.org From 77957795ed9d9496a2adbdbd13a1cb1566bbe7c9 Mon Sep 17 00:00:00 2001 From: zhaozhanqi Date: Thu, 2 Apr 2026 04:24:04 -0400 Subject: [PATCH 2/2] frr-k8s: enable BGP daemon to listen on standard port 179 With -p 0, the BGP daemon does not listen for incoming connections, which breaks the full-mesh iBGP topology used in managed routing mode. Each node must be able to accept BGP sessions from all other nodes, requiring the standard port 179 to be active. --- bindata/network/frr-k8s/config.yaml | 2 +- pkg/network/render.go | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/bindata/network/frr-k8s/config.yaml b/bindata/network/frr-k8s/config.yaml index e261fb79db..a7b64c7142 100644 --- a/bindata/network/frr-k8s/config.yaml +++ b/bindata/network/frr-k8s/config.yaml @@ -46,7 +46,7 @@ data: # vtysh_enable=yes zebra_options=" -A 127.0.0.1 -s 90000000 --limit-fds 100000" - bgpd_options=" -A 127.0.0.1 -p 0 --limit-fds 100000" + bgpd_options=" -A 127.0.0.1 -p {{ if .NoOverlayManagedEnabled }}179{{ else }}0{{ end }} --limit-fds 100000" ospfd_options=" -A 127.0.0.1" ospf6d_options=" -A ::1" ripd_options=" -A 127.0.0.1" diff --git a/pkg/network/render.go b/pkg/network/render.go index 9dfd67bcc9..ffa2579e0f 100644 --- a/pkg/network/render.go +++ b/pkg/network/render.go @@ -860,6 +860,8 @@ func renderAdditionalRoutingCapabilities(conf *operv1.NetworkSpec, manifestDir s data := render.MakeRenderData() data.Data["FRRK8sImage"] = os.Getenv("FRR_K8S_IMAGE") data.Data["ReleaseVersion"] = os.Getenv("RELEASE_VERSION") + data.Data["NoOverlayManagedEnabled"] = conf.DefaultNetwork.OVNKubernetesConfig != nil && + conf.DefaultNetwork.OVNKubernetesConfig.BGPManagedConfig.BGPTopology != "" objs, err := render.RenderDir(filepath.Join(manifestDir, "network/frr-k8s"), &data) if err != nil { return nil, fmt.Errorf("failed to render frr-k8s manifests: %w", err)