Add support for Kind OVNK IPV6 deployment #1751
Conversation
|
🤖 Created branch: z_pr1751/yboaron/ovn_add_ipv6 |
|
@mkolesnik , QQ: I'm getting [1] error when trying to deploy Kind clusters with OVNK and IPV6 with this PR(with make clusters using=ipv6-stack,ovn), while running directly ./ovn-kubernetes/contrib/kind.sh .... things looks fine, any idea ? [1] |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further |
|
🤖 Closed branches: [z_pr1751/yboaron/ovn_add_ipv6] |
|
🤖 Created branch: z_pr1751/yboaron/ovn_add_ipv6 |
This PR depends on ovn-kubernetes PR [1] [1] ovn-kubernetes/ovn-kubernetes#4955 Signed-off-by: Yossi Boaron <[email protected]>
yboaron
requested review from
mkolesnik,
Oats87,
skitt,
sridhargaddam,
tpantelis and
vthapar
as code owners
| @@ -4,7 +4,7 @@ FROM fedora:41 | |||
| # good balance between compression time and resulting image size. | |||
| ARG UPX_LEVEL=-5 | |||
| ENV DAPPER_HOST_ARCH=amd64 SHIPYARD_DIR=/opt/shipyard SHELL=/bin/bash \ | |||
| DAPPER_RUN_ARGS="--net=kind" | |||
| DAPPER_RUN_ARGS="--net=kind --cap-add=NET_ADMIN --privileged=true" | |||
There was a problem hiding this comment.
We only need the extra networking permissions to container for OVN/IPV6 deployment.
@mkolesnik @skitt , is it possible to set DAPPER_RUN_ARGS content based on CNI, IP family env vars ?
There was a problem hiding this comment.
DAPPER_RUN_ARGS is a bit of a cheat — it’s not used as an environment variable as such inside the container, so nothing running in the container can set it meaningfully. The .dapper scripts extracts the value of the variable from the container image before running it.
However since we decide what .dapper does, anything can be done. Could you explain what the exacts criteria (as in, which values in which files) are and which containers need to run with privileges?
There was a problem hiding this comment.
For IPV6 OVN deployment (make clusters using=ipv6-stack,ovn) OVN-K script [1] sets net.ipv6.conf.all.forwarding and sudo sysctl -w net.ipv6.conf.all.disable_ipv6 .
so, container should run with net privileges.
[1]
https://github.com/ovn-kubernetes/ovn-kubernetes/blob/master/contrib/kind.sh#L642
There was a problem hiding this comment.
It only does so if the values don’t match what it expects. Unfortunately GH doesn’t enable IPv6 forwarding by default, so changing that would be necessary.
However it would be possible to do this as an extra step before running the jobs, instead of making the containers themselves privileged…
There was a problem hiding this comment.
There was a problem hiding this comment.
It only does so if the values don’t match what it expects
Yep, without net privileges we can't even read kernel's ipv6 config (sysctl net.ipv6.conf.all.forwarding)
However it would be possible to do this as an extra step before running the jobs, instead of making the containers themselves privileged…
Maybe I'm missing something here, this idea will be useful only on GH, will it be possible to deploy Kind+IPV6,OVN locally without making the containers privileged?
There was a problem hiding this comment.
Yep, without net privileges we can't even read kernel's ipv6 config (sysctl net.ipv6.conf.all.forwarding)
That’s surprising, it works for me and should work fine as long as /proc/sys is mounted in the container (sysctl literally only reads from that).
There was a problem hiding this comment.
For local deployments, we can check the settings early and give an appropriate error, same as for other sysctl settings. In most cases I expect developer machines will be set up with IPv6 enabled and forwarded anyway.
Workaround until commit [1] is delivered in ovn-kubernetes branch [1] ovn-kubernetes/ovn-kubernetes#4955 Signed-off-by: Yossi Boaron <[email protected]>
|
Would it be possible to add an IPv6 deployment in the deployment tests, to check that this does what is expected? |
Depends on: ovn-kubernetes/ovn-kubernetes#4955