In our e2e tests, a strange behaviour for ipv6 was seen:
newly created pod can't reach ipv6 destination.
But if the same pod is re-created, everything works.
We don't know what causes that behaviour, so given function is a
workaround for this issue.
It also only historically fails for the first ef test
"Should validate the egress firewall policy functionality for allowed
IP", so only used there for now.

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Signed-off-by: Martin Kennelly <mkennell@redhat.com>

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

It allows using `*string` as a client index.

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Use freshly-baked libovsdb functionality to index ACLs by sample_new
and sample_est. This allows to avoid expensive predicate search.

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Signed-off-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>

Prior to this PR, we may try to insert a rule to jump
to a chain that doesn't exist.

Signed-off-by: Martin Kennelly <mkennell@redhat.com>

Emit Event if NAD cannot be parsed

ensure that user defined networks are using ipfamilies that the cluster
supports

Signed-off-by: Jacob Tanenbaum <jtanenba@redhat.com>

currently the udn/nad primary network e2e testing does nothing to check
to state of the cluster before creating the network. This makes it
possible to test primary networks with ip families that the underlying
cluster does not support which is not possible.

This commit ensures that e2e testing will only create primary networks
that conform to the cluster being tested

Signed-off-by: Jacob Tanenbaum <jtanenba@redhat.com>

UDN LGW: ensure masq chain exists before adding rules

Signed-off-by: Enrique Llorente <ellorent@redhat.com>

adding testing using User Defined Network objects to pod2Egress testing
and "isolates overlapping CIDRs" tests

Signed-off-by: Jacob Tanenbaum <jtanenba@redhat.com>

This commit is to add some unit tests to make sure proper NAT entries
are being created i NBDB while DisableSNATMultipleGWs is set to true.

Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>

corrections to user defined networking

Add unit tests for UDN while DS is true

…-e2enode

kubevirt, e2e: Use e2enode to label/unlabel

Add a source pod create retry function for egress firewall e2e.

When users attach pod to a secondary network and override the default
route pod. It will cause the assymetric routing for service haripin
traffic.

We add static routes to ensure the traffic to the hairpin masquerade
IP always goes to OVN.

Signed-off-by: Peng Liu <pliu@redhat.com>

There are some expectation at the dev-env interface at metallb that can
change and break ovn-k CI, let's pin it so we can propertly consume
those changes at a PR later on.

Signed-off-by: Enrique Llorente <ellorent@redhat.com>

kind: Pin metallb to v0.14.8

Test opens a TCP connection that simulates a GCP LB environment where
the packet is redirected via iptables to a local server on a node. Note,
in GCP the LB does not DNAT the VIP, so the packet arrives to the node
with the GCP VIP on it. In OCP, we then redirect that packet to the
local kapi server running on the node.

Once the test opens the TCP connection, it leaves it open for 2 minutes
while ovnkube-node is then deleted. Post ovn-controller starting it
should not flush the conntrack in zone 0, and the test ensures that the
conntrack entry still exists.

Recent OVN regression that prompted this E2E: https://issues.redhat.com/browse/FDP-773

Signed-off-by: Tim Rozet <trozet@redhat.com>

Signed-off-by: Tim Rozet <trozet@redhat.com>

Adds e2e test: conntrack flush after ovnkube delete + bumps OVN with fix

When deploying the kind cluster, in order to allow running VMs with
primary-UDN, the kubevirt CR is patched with:
- NetworkBindingPlugins feature gate.
- the passt network binding

Signed-off-by: Ram Lavi <ralavi@redhat.com>

Co-authored-by: Miguel Duarte Barroso <mdbarroso@redhat.com>
Signed-off-by: Ram Lavi <ralavi@redhat.com>

Signed-off-by: Ram Lavi <ralavi@redhat.com>

Separating two different installations into different functions.
In future commit this will allow deploying kubevirt-ipam separately when
needed.

Signed-off-by: Ram Lavi <ralavi@redhat.com>

Although they usually deployed together, ipam may sometimes need to be
deployed out of band for dev purposes.
For this purpose, introducing an opt-out flag that will prevent
installing the latest ipam-controller while still installing
cert-manager.

Signed-off-by: Ram Lavi <ralavi@redhat.com>

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

As a bonus add some coverage to the function that generates the syntetic
network selection element we use to request the primary UDN attachment.

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

Signed-off-by: Enrique Llorente <ellorent@redhat.com>

Co-authored-by: Miguel Duarte Barroso <mdbarroso@redhat.com>
Signed-off-by: Enrique Llorente <ellorent@redhat.com>

Signed-off-by: Enrique Llorente <ellorent@redhat.com>

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

We were setting the hostSubnet as the clusterSubnet
for UDN L3 which was creating wrong routes in ovn
cluster router for UDN

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>

Since hostSubnets was getting feeded as clusterSubnet
when I fixed the hostSubnet in the previous commit
we started to break GR routes Let's also fix that back up.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>

UTs were silently translating /16 to /24
which was not correct. Let's make the
L3 tests pass the nodesubnet in as well
to atleast make it more transparent
which is what.

Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>

OVN-Observability: enable sampling-based observability

UDN: L3: Use nodesubnet annotations for L3; not clustersubnet from NAD

* gateway manager not accounting for different join subnets of UDNs
* tests not expecting the join subnet SNAT when pods snats were disabled
* tests misleadingly naming join ip to the ovn masquerade ip

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

* L3 tests with duplicated names
* L2 duplicated tests of which some were intended to test something else
* L2 secondary tests annotating the wrong IP under the assumption that mgmt and gw IPs would be allocated

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

To avoid being affected by potential dev breakage.

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

UDN gateway & test fixes

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Adds to NetInfo the concept of reconcilable network information. This is
network information that can change dynamically and network controllers
should be able to reconcile. This includes NADs which is information
that network controllers should have already been capable of reconciling
although they currently don't (for example, for multinetwork policies).
Also includes VRFs the network is leaking/advertising to, per node, that
network controllers need to be aware of and rec0oncile as it changes.

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Add the ability for network controllers to reconcile some network
information changes. Currently just changes of the VRFs the network is
leaking/advertising to. Support for reconciling NAD changes is not
included in this commit.

Currently reconciles if the network is advertised or not:
- for OVN network controller to configure or not the pod IP to node IP
  SNAT on the GR for a node of its zone
- for node network controller to configure or not br-ex flows to
  redirect pod IP ingress traffic to the OVN network

This should be enough to provide direct ingress capabilities for the
default network in SGW mode.

Note that secondary network controllers don't reconcile anything as
route advertising is not supported on them. Also cluster manager network
controllers don't reconcile much as they don't have the need.

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

The plan is for the NAD controller to fetch route advertising
information on behalf of network controllers. It will have to do so for
the default network as well and will need access to its network
controller to reconcile that information.

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

As node controllers will need to be informed of related events in new
level driven controllers to come.

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

This annotation will be set by a future cluster manager controller on
the NADs and will list the names of route advertisements that apply to
the given NAD. This will ease processing time of other zone/node
controllers that need to track which route advertisements apply to a
network avoiding them from processing all route advertisements on each
of their reconciliation loops.

Note that this will happen for the default network as well. For that
probably a dummy NAD on ovn-kubernetes namespace is the best option.

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

The network manager running within the NAD controller will, upon
ensuring a network, fetch the VRFs per node a pod network is being
leaked/advertised to from the applicable route advertisements
configuration, and include it in the network information used when
creating a network controller, or triggering a reconciliation if it was
already running.

This relies on annotations set by cluster manager on NADs pointing to
the route advertising configuration that applies to the network which
will come in a future PR/commit.

This includes the default network for which the ever existing default
network controller is used (instead of creating a new network
controller). If necessary, it is assumed that cluster manager will
create a dummy NAD for the default network in ovn-k namespace to set
annotations on. If no NADs for the default network exist or if they have
no annotations, network manager will reconcile the default network to a
default configuration (instead of destroying the network controller).

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

For go-controller:

go get k8s.io/api v0.31.0
go get k8s.io/apimachinery v0.31.0
go get k8s.io/client-go v0.31.0
go get k8s.io/component-helpers v0.31.0
go get k8s.io/kubernetes v1.31.0
go get k8s.io/apiextensions-apiserver v0.31.0 // indirect
go get k8s.io/component-base v0.31.0 // indirect
go get sigs.k8s.io/controller-runtime v0.19.0
go mod vendor && go mod tidy

Fixed API changes and updated codegen

For e2e tests:

go get k8s.io/api v0.31.0
go get k8s.io/apimachinery v0.31.0
go get k8s.io/client-go v0.31.0
go get k8s.io/klog v1.0.0
go get k8s.io/kubernetes v1.31.0
go get k8s.io/pod-security-admission v0.31.0
go get k8s.io/apiextensions-apiserver v0.31.0
go get k8s.io/apiserver v0.31.0
go get k8s.io/cloud-provider v0.31.0
go get k8s.io/component-base v0.31.0
go get k8s.io/component-helpers v0.31.0
go get k8s.io/controller-manager v0.31.0
go get k8s.io/kms v0.31.0
go get k8s.io/kubelet v0.31.0
go get k8s.io/kubectl v0.31.0

(konnectivity-client is not at 0.31 yet)

Fixed API changes

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>

Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>