Skip to content

OCPBUGS-49662: Prevent resetting masquerade subnet #2641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Dec 19, 2025
+23 −1
Merged

OCPBUGS-49662: Prevent resetting masquerade subnet #2641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
326ead3
Update masquerade subnet to ovnkube-control-plane deployment
arghosh93 Feb 5, 2025
df98ce8
Prevent resetting masquerade subnet
arghosh93 Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,15 @@ spec:
ovn_v6_transit_switch_subnet_opt="--cluster-manager-v6-transit-switch-subnet {{.V6TransitSwitchSubnet}}"
fi

ovn_v4_masquerade_subnet_opt=
if [[ "{{.V4MasqueradeSubnet}}" != "" ]]; then
ovn_v4_masquerade_subnet_opt="--gateway-v4-masquerade-subnet {{.V4MasqueradeSubnet}}"
fi
ovn_v6_masquerade_subnet_opt=
if [[ "{{.V6MasqueradeSubnet}}" != "" ]]; then
ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}"
fi

dns_name_resolver_enabled_flag=
if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then
dns_name_resolver_enabled_flag="--enable-dns-name-resolver"
Expand Down Expand Up @@ -211,6 +220,8 @@ spec:
${ovn_v6_join_subnet_opt} \
${ovn_v4_transit_switch_subnet_opt} \
${ovn_v6_transit_switch_subnet_opt} \
${ovn_v4_masquerade_subnet_opt} \
${ovn_v6_masquerade_subnet_opt} \
${dns_name_resolver_enabled_flag} \
${persistent_ips_enabled_flag} \
${multi_network_enabled_flag} \
Expand Down
11 changes: 11 additions & 0 deletions bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,15 @@ spec:
ovn_v6_transit_switch_subnet_opt="--cluster-manager-v6-transit-switch-subnet {{.V6TransitSwitchSubnet}}"
fi

ovn_v4_masquerade_subnet_opt=
if [[ "{{.V4MasqueradeSubnet}}" != "" ]]; then
ovn_v4_masquerade_subnet_opt="--gateway-v4-masquerade-subnet {{.V4MasqueradeSubnet}}"
fi
ovn_v6_masquerade_subnet_opt=
if [[ "{{.V6MasqueradeSubnet}}" != "" ]]; then
ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}"
fi

dns_name_resolver_enabled_flag=
if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then
dns_name_resolver_enabled_flag="--enable-dns-name-resolver"
Expand Down Expand Up @@ -161,6 +170,8 @@ spec:
${ovn_v6_join_subnet_opt} \
${ovn_v4_transit_switch_subnet_opt} \
${ovn_v6_transit_switch_subnet_opt} \
${ovn_v4_masquerade_subnet_opt} \
${ovn_v6_masquerade_subnet_opt} \
${dns_name_resolver_enabled_flag} \
${persistent_ips_enabled_flag} \
${multi_network_enabled_flag} \
Expand Down
2 changes: 1 addition & 1 deletion pkg/network/ovn_kubernetes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1306,7 +1306,7 @@ func bootstrapOVN(conf *operv1.Network, kubeClient cnoclient.Client, infraStatus
}

// set the default masquerade CIDR for new clusters while ignoring upgrades
if res.ControlPlaneUpdateStatus == nil && res.NodeUpdateStatus == nil {
if res.ControlPlaneUpdateStatus == nil || res.NodeUpdateStatus == nil {

@kyrtapz kyrtapz May 14, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if someone removes both the controlplane and the dataplane components?

@arghosh93 arghosh93 May 15, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I remove both ovnkube-node DS and ovnkube-control-plane deployment then also masquerade subnet does not get reverted back to old default subnets.
Do you anticipate this change may override old default masquerade subnets during a upgrade? Then I would say this change is not sufficient to address the issue.

@arghosh93 arghosh93 May 15, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have tried to upgrade from one version to other(4.17-4.18) and I dont see ovnkube-node DS and ovnkube-control-plane deployment being deleted and instead all images get changed.

@arghosh93 arghosh93 Aug 4, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kyrtapz should we move forward with this change?

@kyrtapz kyrtapz Aug 4, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upgrades are not removing the daemonset either. I thought this fix is to address the corner case of users removing the ovn-k daemonset?

@arghosh93 arghosh93 Aug 4, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, correct. Masquerade subnet gets reset when either ovnkube-node daemonset or ovnkube-control-plane deployment is removed manually.

klog.Infof("Configuring the default masquerade subnets to %q and %q", defaultV4MasqueradeSubnet, defaultV6MasqueradeSubnet)
res.DefaultV4MasqueradeSubnet = defaultV4MasqueradeSubnet
res.DefaultV6MasqueradeSubnet = defaultV6MasqueradeSubnet
Expand Down