From 326ead348ab729941dbe0875334c6304e3495c5b Mon Sep 17 00:00:00 2001 From: Arnab Ghosh Date: Wed, 5 Feb 2025 17:59:54 +0530 Subject: [PATCH 1/2] Update masquerade subnet to ovnkube-control-plane deployment ovnkube running in ovnkube-control-plane need to know about masquerade subnet as it is currently configurable at day 2. If ovnkube is not aware of custom masquerade subnet, then subnet overlap check at ovnkube side during startup would consider default masquerade subnet and overlap check would be inaccurate. Signed-off-by: Arnab Ghosh --- .../ovn-kubernetes/managed/ovnkube-control-plane.yaml | 11 +++++++++++ .../self-hosted/ovnkube-control-plane.yaml | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml b/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml index 6edfc577ac..950726ee13 100644 --- a/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml +++ b/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml @@ -171,6 +171,15 @@ spec: ovn_v6_transit_switch_subnet_opt="--cluster-manager-v6-transit-switch-subnet {{.V6TransitSwitchSubnet}}" fi + ovn_v4_masquerade_subnet_opt= + if [[ "{{.V4MasqueradeSubnet}}" != "" ]]; then + ovn_v4_masquerade_subnet_opt="--gateway-v4-masquerade-subnet {{.V4MasqueradeSubnet}}" + fi + ovn_v6_masquerade_subnet_opt= + if [[ "{{.V6MasqueradeSubnet}}" != "" ]]; then + ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}" + fi + dns_name_resolver_enabled_flag= if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then dns_name_resolver_enabled_flag="--enable-dns-name-resolver" @@ -211,6 +220,8 @@ spec: ${ovn_v6_join_subnet_opt} \ ${ovn_v4_transit_switch_subnet_opt} \ ${ovn_v6_transit_switch_subnet_opt} \ + ${ovn_v4_masquerade_subnet_opt} \ + ${ovn_v6_masquerade_subnet_opt} \ ${dns_name_resolver_enabled_flag} \ ${persistent_ips_enabled_flag} \ ${multi_network_enabled_flag} \ diff --git a/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml b/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml index 75a2ddff25..daf27666c9 100644 --- a/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml +++ b/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml @@ -124,6 +124,15 @@ spec: ovn_v6_transit_switch_subnet_opt="--cluster-manager-v6-transit-switch-subnet {{.V6TransitSwitchSubnet}}" fi + ovn_v4_masquerade_subnet_opt= + if [[ "{{.V4MasqueradeSubnet}}" != "" ]]; then + ovn_v4_masquerade_subnet_opt="--gateway-v4-masquerade-subnet {{.V4MasqueradeSubnet}}" + fi + ovn_v6_masquerade_subnet_opt= + if [[ "{{.V6MasqueradeSubnet}}" != "" ]]; then + ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}" + fi + dns_name_resolver_enabled_flag= if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then dns_name_resolver_enabled_flag="--enable-dns-name-resolver" @@ -161,6 +170,8 @@ spec: ${ovn_v6_join_subnet_opt} \ ${ovn_v4_transit_switch_subnet_opt} \ ${ovn_v6_transit_switch_subnet_opt} \ + ${ovn_v4_masquerade_subnet_opt} \ + ${ovn_v6_masquerade_subnet_opt} \ ${dns_name_resolver_enabled_flag} \ ${persistent_ips_enabled_flag} \ ${multi_network_enabled_flag} \ From df98ce89740931793192f4b9a1a2d39f2a87ec87 Mon Sep 17 00:00:00 2001 From: Arnab Ghosh Date: Wed, 5 Feb 2025 18:23:22 +0530 Subject: [PATCH 2/2] Prevent resetting masquerade subnet Prevent resetting masquerade subnet to default value(169.254.169.0/29) set at upstream ovn-kubernetes when ovnkube-node daemonset is removed from the cluster. If masquerade subnet is configured through network.operator custom resource then it takes precedence over default masquerade subnet. Signed-off-by: Arnab Ghosh --- pkg/network/ovn_kubernetes.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/network/ovn_kubernetes.go b/pkg/network/ovn_kubernetes.go index a7ffaf0045..b74e5edb64 100644 --- a/pkg/network/ovn_kubernetes.go +++ b/pkg/network/ovn_kubernetes.go @@ -1306,7 +1306,7 @@ func bootstrapOVN(conf *operv1.Network, kubeClient cnoclient.Client, infraStatus } // set the default masquerade CIDR for new clusters while ignoring upgrades - if res.ControlPlaneUpdateStatus == nil && res.NodeUpdateStatus == nil { + if res.ControlPlaneUpdateStatus == nil || res.NodeUpdateStatus == nil { klog.Infof("Configuring the default masquerade subnets to %q and %q", defaultV4MasqueradeSubnet, defaultV6MasqueradeSubnet) res.DefaultV4MasqueradeSubnet = defaultV4MasqueradeSubnet res.DefaultV6MasqueradeSubnet = defaultV6MasqueradeSubnet