From 39a42ae1a5e2867e698cbb627699da53ccc21f76 Mon Sep 17 00:00:00 2001 From: Arnab Ghosh Date: Wed, 5 Feb 2025 17:59:54 +0530 Subject: [PATCH 1/2] Update masquerade subnet to ovnkube-control-plane deployment ovnkube running in ovnkube-control-plane need to know about masquerade subnet as it is currently configurable at day 2. If ovnkube is not aware of custom masquerade subnet, then subnet overlap check at ovnkube side during startup would consider default masquerade subnet and overlap check would be inaccurate. Signed-off-by: Arnab Ghosh --- .../ovn-kubernetes/managed/ovnkube-control-plane.yaml | 11 +++++++++++ .../self-hosted/ovnkube-control-plane.yaml | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml b/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml index 2048403dd9..262923675d 100644 --- a/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml +++ b/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml @@ -173,6 +173,15 @@ spec: ovn_v6_transit_switch_subnet_opt="--cluster-manager-v6-transit-subnet {{.V6TransitSwitchSubnet}}" fi + ovn_v4_masquerade_subnet_opt= + if [[ "{{.V4MasqueradeSubnet}}" != "" ]]; then + ovn_v4_masquerade_subnet_opt="--gateway-v4-masquerade-subnet {{.V4MasqueradeSubnet}}" + fi + ovn_v6_masquerade_subnet_opt= + if [[ "{{.V6MasqueradeSubnet}}" != "" ]]; then + ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}" + fi + dns_name_resolver_enabled_flag= if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then dns_name_resolver_enabled_flag="--enable-dns-name-resolver" @@ -232,6 +241,8 @@ spec: ${ovn_v6_join_subnet_opt} \ ${ovn_v4_transit_switch_subnet_opt} \ ${ovn_v6_transit_switch_subnet_opt} \ + ${ovn_v4_masquerade_subnet_opt} \ + ${ovn_v6_masquerade_subnet_opt} \ ${dns_name_resolver_enabled_flag} \ ${persistent_ips_enabled_flag} \ ${multi_network_enabled_flag} \ diff --git a/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml b/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml index 394488ecda..df8a7e029c 100644 --- a/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml +++ b/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml @@ -124,6 +124,15 @@ spec: ovn_v6_transit_switch_subnet_opt="--cluster-manager-v6-transit-subnet {{.V6TransitSwitchSubnet}}" fi + ovn_v4_masquerade_subnet_opt= + if [[ "{{.V4MasqueradeSubnet}}" != "" ]]; then + ovn_v4_masquerade_subnet_opt="--gateway-v4-masquerade-subnet {{.V4MasqueradeSubnet}}" + fi + ovn_v6_masquerade_subnet_opt= + if [[ "{{.V6MasqueradeSubnet}}" != "" ]]; then + ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}" + fi + dns_name_resolver_enabled_flag= if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then dns_name_resolver_enabled_flag="--enable-dns-name-resolver" @@ -189,6 +198,8 @@ spec: ${ovn_v6_join_subnet_opt} \ ${ovn_v4_transit_switch_subnet_opt} \ ${ovn_v6_transit_switch_subnet_opt} \ + ${ovn_v4_masquerade_subnet_opt} \ + ${ovn_v6_masquerade_subnet_opt} \ ${dns_name_resolver_enabled_flag} \ ${persistent_ips_enabled_flag} \ ${multi_network_enabled_flag} \ From 7e0a9c0de83999953ce4afa2dd64ac531a49992a Mon Sep 17 00:00:00 2001 From: Arnab Ghosh Date: Wed, 5 Feb 2025 18:23:22 +0530 Subject: [PATCH 2/2] Prevent resetting masquerade subnet Prevent resetting masquerade subnet to default value(169.254.169.0/29) set at upstream ovn-kubernetes when ovnkube-node daemonset is removed from the cluster. If masquerade subnet is configured through network.operator custom resource then it takes precedence over default masquerade subnet. Signed-off-by: Arnab Ghosh --- pkg/network/ovn_kubernetes.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/network/ovn_kubernetes.go b/pkg/network/ovn_kubernetes.go index 55b1964982..54787e90c2 100644 --- a/pkg/network/ovn_kubernetes.go +++ b/pkg/network/ovn_kubernetes.go @@ -1402,7 +1402,7 @@ func bootstrapOVN(conf *operv1.Network, kubeClient cnoclient.Client, infraStatus } // set the default masquerade CIDR for new clusters while ignoring upgrades - if res.ControlPlaneUpdateStatus == nil && res.NodeUpdateStatus == nil { + if res.ControlPlaneUpdateStatus == nil || res.NodeUpdateStatus == nil { klog.Infof("Configuring the default masquerade subnets to %q and %q", defaultV4MasqueradeSubnet, defaultV6MasqueradeSubnet) res.DefaultV4MasqueradeSubnet = defaultV4MasqueradeSubnet res.DefaultV6MasqueradeSubnet = defaultV6MasqueradeSubnet