Enhancement proposal for OVN secondary networks #811

maiqueb · 2021-06-15T16:16:47Z

No description provided.

openshift-ci · 2021-06-15T16:16:55Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

Also add an example featuring external network connectivity. Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

maiqueb · 2021-08-03T09:54:13Z

/cc @alexanderConstantinescu @dcbw @dougbtv @trozet

squeed · 2021-08-03T11:55:18Z

I believe we had talked about a CRD for defining OVN-Kubernetes networks, rather than pulling them from the NAD. Do you still want to work on that?

maiqueb · 2021-08-03T12:03:30Z

I believe we had talked about a CRD for defining OVN-Kubernetes networks, rather than pulling them from the NAD. Do you still want to work on that?

Sure @squeed, just pushed a version with that I had half-prepared.

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

mikemckiernan · 2021-08-03T12:54:28Z

My comment is pretty close to cosmetic, so I'll make it here rather than in a review. In the spec.config, can you use hasExternalConnectivity rather than has_external_connectivity? I believe that mixed case is the convention and would provide a consistent end-user experience.

I skimmed a bit at https://github.com/containernetworking/cni, but I could not locate explicit guidance.

dcbw · 2021-08-17T13:13:53Z

enhancements/network/ovn-secondary-networks.md

+
+type OVNSecondaryNetworkSpec struct {
+    // Subnet is a RFC 4632/4291-style string that represents an IP address and prefix length in CIDR notation
+    Subnet                  string `json:"subnet"`


How are subnets validated? Do we prevent overlapping subnets with other things in the cluster? (other secondary networks, node CIDRs for the primary network, ClusterCIDR, serviceCIDR, etc)

Hm, I guess that it only matters if the overlay has external connectivity.

We could ensure that we only render NADs for disconnected subnets, or for subnets with external connectivities that do not clash with the subnets you've listed.

Two things:
1 - Can you explain what this field does? Does it provide IPAM, or is it just for routing? Does it cause a gateway to be created (at the .1)? Too much magic in this field...
2 - This should always be an array for dual-stack (or just disjoint ranges).

Two things:
1 - Can you explain what this field does? Does it provide IPAM, or is it just for routing? Does it cause a gateway to be created (at the .1)? Too much magic in this field...

I'll explain better.

2 - This should always be an array for dual-stack (or just disjoint ranges).

I am proposing a very simple model here; one IP per interface, and 1 subnet per logical switch. If the user desires dual stack, the option would be to create 2 OverlayNetworks, each with an IP version.

Is this model too narrow minded ?

Starting simple is fine. However, let's just make this dual-stack from the get-go.

A convention is to have arrays for all IPs, and reject as invalid if there is more than one ip / cidr per family.

dcbw · 2021-08-17T13:14:59Z

enhancements/network/ovn-secondary-networks.md

+type OVNSecondaryNetworkSpec struct {
+    // Subnet is a RFC 4632/4291-style string that represents an IP address and prefix length in CIDR notation
+    Subnet                  string `json:"subnet"`
+    HasExternalConnectivity bool   `json:"hasExternalConnectivity,omitempty"`


Should spell out the guarantees around this. Is traffic going to be NAT-ed? Directly dumped onto the host's underlay? If NAT then what IP does it get NAT-ed to? Are there any guarantees around ingress to this network, or is only reply traffic that is allowed?

No ingress at all is in scope of this feature; We might eventually desire it, but it would be only via kubernetes services, which still need to be made available for secondary networks. I can add this to the non-goals section of this enhancement proposal, for clarity.

Regarding how egress is implemented, I would prefer to avoid NAT - using a localnet port on the overlay logical switch seems preferable.

Perhaps ExternalConnectivity should be its own struct, to allow for expansion? What potential options are there?

no external access

using the node's gateway router

A centralized gateway

Using the node's gateway router, afaiu, implies that we will be sharing the OVN db between OVN-K and whatever implements these overlays, right ?

That would only be an option if this feature is implemented in OVN-Kubernetes - and, imo, is one of the advantages of implementing it there - i.e. we wouldn't need to implement a centralized gateway to provide external connectivity to the pods.

Never-the-less, I think having ExternalConnectivity as a separate struct is a good suggestion, I'll model it; thanks!

openshift-bot · 2022-07-19T13:57:04Z

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

maiqueb · 2022-07-19T14:11:35Z

/remove-lifecycle stale

openshift-bot · 2022-08-17T01:16:08Z

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2022-08-24T08:45:58Z

Stale enhancement proposals rot after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Rotten proposals close after an additional 7d of inactivity.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

maiqueb · 2022-08-24T08:55:36Z

/remove-lifecycle rotten

dhellmann · 2022-08-25T20:37:20Z

/close

Since this isn't being actively developed, let's close the PR to keep the review queue clear for work that is more urgent. We can reopen this PR or submit a new one when work resumes.

openshift-ci · 2022-08-25T20:37:48Z

@dhellmann: Closed this PR.

In response to this:

/close

Since this isn't being actively developed, let's close the PR to keep the review queue clear for work that is more urgent. We can reopen this PR or submit a new one when work resumes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

maiqueb · 2023-01-13T09:21:31Z

/reopen

We will resume work on this enhancement in the following days / weeks.

openshift-ci · 2023-01-13T09:21:41Z

@maiqueb: Reopened this PR.

In response to this:

/reopen

We will resume work on this enhancement in the following days / weeks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-01-13T09:22:03Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dougbtv for approval by writing /assign @dougbtv in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

enhancements/network/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-01-13T09:28:37Z

@maiqueb: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/markdownlint	`1084e79`	link	true	`/test markdownlint`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2023-02-11T01:15:33Z

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2023-02-18T08:46:00Z

Stale enhancement proposals rot after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Rotten proposals close after an additional 7d of inactivity.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-bot · 2023-02-26T00:15:48Z

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

openshift-ci · 2023-02-26T00:15:59Z

@openshift-bot: Closed this PR.

In response to this:

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 15, 2021

openshift-ci bot requested review from abhat and squeed June 15, 2021 16:16

maiqueb force-pushed the ovn-secondary-networks branch from 9432582 to a2dbbe3 Compare June 22, 2021 12:01

maiqueb marked this pull request as ready for review June 23, 2021 14:19

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 23, 2021

maiqueb force-pushed the ovn-secondary-networks branch 2 times, most recently from 4c8370c to 78e7600 Compare June 23, 2021 15:05

maiqueb added 8 commits July 23, 2021 11:35

network, secondary ovn: introduction section + examples

9762b0f

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

network, secondary ovn: add graduation criteria

a6074af

Also add an example featuring external network connectivity. Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

network, secondary ovn: add design details

d4127c8

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

network, ovn secondary ifaces: discuss where to host the code

56feac0

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

Point to multi-network policy proposal

aef122e

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

network, ovn secondary nets: link to the NAD examples

b8a4705

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

network, ovn secondary nets: add the missing template sections

5dc2b61

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

network, ovn secondary nets: provide test plan draft

065e44d

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

openshift-ci bot requested review from alexanderConstantinescu, dcbw, dougbtv and trozet August 3, 2021 09:54

maiqueb force-pushed the ovn-secondary-networks branch from aa04fd2 to 042522e Compare August 3, 2021 12:02

add specialized CRD to render a NAD

61e3034

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

maiqueb force-pushed the ovn-secondary-networks branch from 042522e to 61e3034 Compare August 3, 2021 12:14

dcbw reviewed Aug 17, 2021

View reviewed changes

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 19, 2022

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 19, 2022

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 17, 2022

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 24, 2022

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 24, 2022

openshift-ci bot closed this Aug 25, 2022

maiqueb mentioned this pull request Aug 29, 2022

Prepare for ovn-k8s multi-home pods support - MR1 ovn-kubernetes/ovn-kubernetes#3048

Merged

openshift-ci bot reopened this Jan 13, 2023

maiqueb mentioned this pull request Jan 25, 2023

[WIP] Pod network crd ovn-kubernetes/ovn-kubernetes#3379

Closed

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 11, 2023

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Feb 18, 2023

openshift-ci bot closed this Feb 26, 2023

arghosh93 mentioned this pull request Sep 21, 2023

issues.redhat.com/browse/OCPBUGS-18591 arghosh93/ovn-kubernetes#2

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enhancement proposal for OVN secondary networks #811

Enhancement proposal for OVN secondary networks #811

maiqueb commented Jun 15, 2021

openshift-ci bot commented Jun 15, 2021

maiqueb commented Aug 3, 2021

squeed commented Aug 3, 2021

maiqueb commented Aug 3, 2021

mikemckiernan commented Aug 3, 2021

dcbw Aug 17, 2021

maiqueb Aug 18, 2021

squeed Aug 23, 2021

maiqueb Aug 23, 2021

squeed Aug 24, 2021

maiqueb Aug 25, 2021

dcbw Aug 17, 2021

maiqueb Aug 18, 2021

squeed Aug 23, 2021

maiqueb Aug 23, 2021 •

edited

Loading

openshift-bot commented Jul 19, 2022

maiqueb commented Jul 19, 2022

openshift-bot commented Aug 17, 2022

openshift-bot commented Aug 24, 2022

maiqueb commented Aug 24, 2022

dhellmann commented Aug 25, 2022

openshift-ci bot commented Aug 25, 2022

maiqueb commented Jan 13, 2023

openshift-ci bot commented Jan 13, 2023

openshift-ci bot commented Jan 13, 2023

openshift-ci bot commented Jan 13, 2023

openshift-bot commented Feb 11, 2023

openshift-bot commented Feb 18, 2023

openshift-bot commented Feb 26, 2023

openshift-ci bot commented Feb 26, 2023

Enhancement proposal for OVN secondary networks #811

Enhancement proposal for OVN secondary networks #811

Conversation

maiqueb commented Jun 15, 2021

openshift-ci bot commented Jun 15, 2021

maiqueb commented Aug 3, 2021

squeed commented Aug 3, 2021

maiqueb commented Aug 3, 2021

mikemckiernan commented Aug 3, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maiqueb Aug 23, 2021 • edited Loading

Choose a reason for hiding this comment

openshift-bot commented Jul 19, 2022

maiqueb commented Jul 19, 2022

openshift-bot commented Aug 17, 2022

openshift-bot commented Aug 24, 2022

maiqueb commented Aug 24, 2022

dhellmann commented Aug 25, 2022

openshift-ci bot commented Aug 25, 2022

maiqueb commented Jan 13, 2023

openshift-ci bot commented Jan 13, 2023

openshift-ci bot commented Jan 13, 2023

openshift-ci bot commented Jan 13, 2023

openshift-bot commented Feb 11, 2023

openshift-bot commented Feb 18, 2023

openshift-bot commented Feb 26, 2023

openshift-ci bot commented Feb 26, 2023

maiqueb Aug 23, 2021 •

edited

Loading