Add option to disable udn-host-isolation.

UDN host isolation requires a kernel fix. Turn it off by default in ovnkube.sh (aka in our kind cluster). As soon as the fix becomes available for github runners (and dev environments), this flag will be removed from ovnkube.sh (and potentially from the code). This flag only takes effect when network segmentation is enabled. Add DISABLE_UDN_HOST_ISOLATION env variable to test workflow, that is set to true. Skip host isolation tests based on the value. Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>
ovn-org · Oct 23, 2024 · 71ad044 · 71ad044
1 parent a3f6743
commit 71ad044
Show file tree

Hide file tree

Showing 6 changed files with 73 additions and 56 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -452,6 +452,7 @@ jobs:
       KIND_IPV6_SUPPORT: "${{ matrix.ipfamily == 'IPv6' || matrix.ipfamily == 'dualstack' }}"
       ENABLE_MULTI_NET: "${{ matrix.target == 'multi-homing' || matrix.target == 'kv-live-migration' || matrix.target == 'network-segmentation' || matrix.target == 'tools' || matrix.target == 'multi-homing-helm' }}"
       ENABLE_NETWORK_SEGMENTATION: "${{ matrix.target == 'network-segmentation' || matrix.target == 'tools' || matrix.target == 'kv-live-migration'}}"
+      DISABLE_UDN_HOST_ISOLATION: "true"
       KIND_INSTALL_KUBEVIRT: "${{ matrix.target == 'kv-live-migration' }}"
       OVN_COMPACT_MODE: "${{ matrix.target == 'compact-mode' }}"
       OVN_DUMMY_GATEWAY_BRIDGE: "${{ matrix.target == 'compact-mode' }}"

diff --git a/dist/images/ovnkube.sh b/dist/images/ovnkube.sh
@@ -1638,6 +1638,7 @@ ovnkube-controller() {
     --metrics-bind-address ${ovnkube_master_metrics_bind_address} \
     --metrics-enable-pprof \
     --pidfile ${OVN_RUNDIR}/ovnkube-controller.pid \
+    --disable-udn-host-isolation \
     --zone ${ovn_zone} &
 
   echo "=============== ovnkube-controller ========== running"

diff --git a/go-controller/pkg/config/config.go b/go-controller/pkg/config/config.go
@@ -417,14 +417,17 @@ type OVNKubernetesFeatureConfig struct {
 	EgressIPNodeHealthCheckPort     int  `gcfg:"egressip-node-healthcheck-port"`
 	EnableMultiNetwork              bool `gcfg:"enable-multi-network"`
 	EnableNetworkSegmentation       bool `gcfg:"enable-network-segmentation"`
-	EnableMultiNetworkPolicy        bool `gcfg:"enable-multi-networkpolicy"`
-	EnableStatelessNetPol           bool `gcfg:"enable-stateless-netpol"`
-	EnableInterconnect              bool `gcfg:"enable-interconnect"`
-	EnableMultiExternalGateway      bool `gcfg:"enable-multi-external-gateway"`
-	EnablePersistentIPs             bool `gcfg:"enable-persistent-ips"`
-	EnableDNSNameResolver           bool `gcfg:"enable-dns-name-resolver"`
-	EnableServiceTemplateSupport    bool `gcfg:"enable-svc-template-support"`
-	EnableObservability             bool `gcfg:"enable-observability"`
+	// This feature requires a kernel fix https://github.com/torvalds/linux/commit/7f3287db654395f9c5ddd246325ff7889f550286
+	// to work on a kind cluster. Flag allows to disable it for current CI, will be turned on when github runners have this fix.
+	DisableUDNHostIsolation      bool `gcfg:"disable-udn-host-isolation"`
+	EnableMultiNetworkPolicy     bool `gcfg:"enable-multi-networkpolicy"`
+	EnableStatelessNetPol        bool `gcfg:"enable-stateless-netpol"`
+	EnableInterconnect           bool `gcfg:"enable-interconnect"`
+	EnableMultiExternalGateway   bool `gcfg:"enable-multi-external-gateway"`
+	EnablePersistentIPs          bool `gcfg:"enable-persistent-ips"`
+	EnableDNSNameResolver        bool `gcfg:"enable-dns-name-resolver"`
+	EnableServiceTemplateSupport bool `gcfg:"enable-svc-template-support"`
+	EnableObservability          bool `gcfg:"enable-observability"`
 }
 
 // GatewayMode holds the node gateway mode

diff --git a/go-controller/pkg/node/default_node_network_controller.go b/go-controller/pkg/node/default_node_network_controller.go
@@ -142,7 +142,7 @@ func newDefaultNodeNetworkController(cnnci *CommonNodeNetworkControllerInfo, sto
 		},
 		routeManager: routeManager,
 	}
-	if util.IsNetworkSegmentationSupportEnabled() {
+	if util.IsNetworkSegmentationSupportEnabled() && !config.OVNKubernetesFeature.DisableUDNHostIsolation {
 		c.udnHostIsolationManager = NewUDNHostIsolationManager(config.IPv4Mode, config.IPv6Mode,
 			cnnci.watchFactory.PodCoreInformer(), nadController)
 	}

diff --git a/test/e2e/network_segmentation.go b/test/e2e/network_segmentation.go
@@ -340,48 +340,51 @@ var _ = Describe("Network Segmentation", func() {
 						}, 10*time.Second, 1*time.Second).Should(BeTrue())
 						Expect(udnPod.Status.ContainerStatuses[0].RestartCount).To(Equal(int32(0)))
 
-						By("checking default network hostNetwork pod and non-kubelet host process can't reach the UDN pod")
-						hostNetPod, err := createPod(f, "host-net-pod", udnPodConfig.nodeSelector[nodeHostnameKey],
-							defaultNetNamespace, []string{}, nil, func(pod *v1.Pod) {
-								pod.Spec.HostNetwork = true
-							})
-						Expect(err).NotTo(HaveOccurred())
 
-						// positive check for reachable default network pod
-						for _, destIP := range []string{defaultIPv4, defaultIPv6} {
-							if destIP == "" {
-								continue
-							}
-							By("checking the default network hostNetwork can reach default pod on IP " + destIP)
-							Eventually(func() bool {
-								return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, defaultPort) == nil
-							}).Should(BeTrue())
-							By("checking the non-kubelet host process can reach default pod on IP " + destIP)
-							Eventually(func() bool {
-								_, err = runCommand(containerRuntime, "exec", workerOneNodeName,
-									"curl", "--connect-timeout", "2",
-									net.JoinHostPort(destIP, fmt.Sprintf("%d", defaultPort)))
-								return err == nil
-							}).Should(BeTrue())
-						}
-						// negative check for UDN pod
-						for _, destIP := range []string{udnIPv4, udnIPv6} {
-							if destIP == "" {
-								continue
-							}
+						if !isUDNHostIsolationDisabled() {
+							By("checking default network hostNetwork pod and non-kubelet host process can't reach the UDN pod")
+							hostNetPod, err := createPod(f, "host-net-pod", udnPodConfig.nodeSelector[nodeHostnameKey],
+								defaultNetNamespace, []string{}, nil, func(pod *v1.Pod) {
+									pod.Spec.HostNetwork = true
+								})
+							Expect(err).NotTo(HaveOccurred())
 
-							By("checking the default network hostNetwork pod can't reach UDN pod on IP " + destIP)
-							Consistently(func() bool {
-								return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
-							}, 5*time.Second).Should(BeTrue())
+							// positive check for reachable default network pod
+							for _, destIP := range []string{defaultIPv4, defaultIPv6} {
+								if destIP == "" {
+									continue
+								}
+								By("checking the default network hostNetwork can reach default pod on IP " + destIP)
+								Eventually(func() bool {
+									return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, defaultPort) == nil
+								}).Should(BeTrue())
+								By("checking the non-kubelet host process can reach default pod on IP " + destIP)
+								Eventually(func() bool {
+									_, err = runCommand(containerRuntime, "exec", workerOneNodeName,
+										"curl", "--connect-timeout", "2",
+										net.JoinHostPort(destIP, fmt.Sprintf("%d", defaultPort)))
+									return err == nil
+								}).Should(BeTrue())
+							}
+							// negative check for UDN pod
+							for _, destIP := range []string{udnIPv4, udnIPv6} {
+								if destIP == "" {
+									continue
+								}
 
-							By("checking the non-kubelet host process can't reach UDN pod on IP " + destIP)
-							Consistently(func() bool {
-								_, err = runCommand(containerRuntime, "exec", workerOneNodeName,
-									"curl", "--connect-timeout", "2",
-									net.JoinHostPort(destIP, fmt.Sprintf("%d", port)))
-								return err != nil
-							}, 5*time.Second).Should(BeTrue())
+								By("checking the default network hostNetwork pod can't reach UDN pod on IP " + destIP)
+								Consistently(func() bool {
+									return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
+								}, 5*time.Second).Should(BeTrue())
+
+								By("checking the non-kubelet host process can't reach UDN pod on IP " + destIP)
+								Consistently(func() bool {
+									_, err = runCommand(containerRuntime, "exec", workerOneNodeName,
+										"curl", "--connect-timeout", "2",
+										net.JoinHostPort(destIP, fmt.Sprintf("%d", port)))
+									return err != nil
+								}, 5*time.Second).Should(BeTrue())
+							}
 						}
 
 						By("asserting UDN pod can reach the kapi service in the default network")
@@ -1046,10 +1049,12 @@ spec:
 					return connectToServer(podConfiguration{namespace: defaultClientPod.Namespace, name: defaultClientPod.Name}, destIP, port) != nil
 				}, 5*time.Second).Should(BeTrue())
 
-				By("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP)
-				Consistently(func() bool {
-					return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
-				}, 5*time.Second).Should(BeTrue())
+				if !isUDNHostIsolationDisabled() {
+					By("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP)
+					Consistently(func() bool {
+						return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
+					}, 5*time.Second).Should(BeTrue())
+				}
 			}
 
 			By("Open UDN pod port")
@@ -1094,10 +1099,12 @@ spec:
 					return connectToServer(podConfiguration{namespace: defaultClientPod.Namespace, name: defaultClientPod.Name}, destIP, port) != nil
 				}, 5*time.Second).Should(BeTrue())
 
-				By("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP)
-				Eventually(func() bool {
-					return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
-				}, 5*time.Second).Should(BeTrue())
+				if !isUDNHostIsolationDisabled() {
+					By("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP)
+					Eventually(func() bool {
+						return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
+					}, 5*time.Second).Should(BeTrue())
+				}
 			}
 			By("Verify syntax error is reported via event")
 			events, err := cs.CoreV1().Events(udnPod.Namespace).List(context.Background(), metav1.ListOptions{})

diff --git a/test/e2e/util.go b/test/e2e/util.go
@@ -1105,6 +1105,11 @@ func isInterconnectEnabled() bool {
 	return present && val == "true"
 }
 
+func isUDNHostIsolationDisabled() bool {
+	val, present := os.LookupEnv("DISABLE_UDN_HOST_ISOLATION")
+	return present && val == "true"
+}
+
 func isLocalGWModeEnabled() bool {
 	val, present := os.LookupEnv("OVN_GATEWAY_MODE")
 	return present && val == "local"