Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPBUGS-44655,OCPBUGS-43083: Fix IPv6 Disconnected HCP deployments #5168

Merged
merged 2 commits into from
Dec 18, 2024
Merged

OCPBUGS-44655,OCPBUGS-43083: Fix IPv6 Disconnected HCP deployments #5168

merged 2 commits into from
Dec 18, 2024
+1,208 −252

Conversation

jparrill
Copy link
Contributor

@jparrill jparrill commented Nov 21, 2024 •
edited
Loading

The issue with the MultiArch check is that it's recovering the manifests without passing through ImageMetadaProvider. I've added a new method to that which recovers the requested manifest and adds it to a new LRU Cache.

To pass the ImageMetadataProvider to the RegistryClient, implies to fall in a import cycle issue, so a new interface was created called ManifestProvider, which implement the same GetManifest methods as the original does.

Which issue(s) this PR fixes:
Fixes:

  • OCPBUGS-44655 - HO issue determining the cluster payload arch does not checks the ICSP/IDMS
  • OCPBUGS-43083 - Pods cannot connect to apiserver in IPv6 disconnected hosted cluster

Issues Solved

  • Detecting MultiArch cannot get the right manifest (original GetManifests is not using the ImageMetadataProvider)
    • Implemented GetManifests method inside of ImageMetadataProvider
  • ImageMetadataProvider does not understand the IDMS with only the domain (exact match works fine
    • Patched GetOverrideImages to understand IDMS namespace wildcards
  • CVO is being override by a EnvVar and not getting the digest from OCP release
    • Implemented GetDigest method inside of ImageMetadataProvider
  • CVO deployment’s payload-script does not contain EOF
  • IPv6 does not work, nodes cannot join the KAS
    • The IsIPv4 function now accepts IPAddresses instead of only CIDRs.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 21, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Nov 21, 2024

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci-robot openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Nov 21, 2024
@openshift-ci-robot
Copy link

@jparrill: This pull request references Jira Issue OCPBUGS-44655, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.18.0) matches configured target version for branch (4.18.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (gamado@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

The issue with the MultiArch check is that it's recovering the manifests without passing through ImageMetadaProvider. I've added a new method to that which recovers the requested manifest and adds it to a new LRU Cache.

To pass the ImageMetadataProvider to the RegistryClient, implies to fall in a import cycle issue, so a new interface was created called ManifestProvider, which implement the same GetManifest methods as the original does.

Which issue(s) this PR fixes:
Fixes #OCPBUGS-44655

Checklist

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Nov 21, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Nov 21, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed do-not-merge/needs-area labels Nov 21, 2024
@netlify Netlify
Copy link

netlify bot commented Nov 21, 2024

✅ Deploy Preview for hypershift-docs ready!

Name Link
🔨 Latest commit e20a560
🔍 Latest deploy log https://app.netlify.com/sites/hypershift-docs/deploys/673f31bfb0301f00084a78f2
😎 Deploy Preview https://deploy-preview-5168--hypershift-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@jparrill jparrill force-pushed the OCPBUGS-44655 branch 2 times, most recently from 7e1e1e5 to 9f0f11a Compare November 26, 2024 11:03
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 26, 2024
@openshift-ci openshift-ci bot added the area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release label Nov 26, 2024
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 26, 2024
@jparrill jparrill marked this pull request as ready for review November 26, 2024 11:24
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 26, 2024
@openshift-ci openshift-ci bot requested review from hasueki and sjenning November 26, 2024 11:24
@jparrill jparrill force-pushed the OCPBUGS-44655 branch 3 times, most recently from f201f7d to 77e573c Compare November 26, 2024 17:43
@jparrill
Copy link
Contributor Author

/retest

@jparrill
Copy link
Contributor Author

/hold a bit

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 28, 2024
@jparrill
Copy link
Contributor Author

I have present that I need to add the unit tests for discoverCVOReleaseImages new function included in the PR. I will do it in a follow up PR because I need this PR merged for code freeze.

@jparrill
Copy link
Contributor Author

/retest

1 similar comment
@jparrill
Copy link
Contributor Author

/retest

@jparrill
OCPBUGS-44655: Fix multiarch validations using MetadataProvider
7ee654e 
Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>
@jparrill
OCPBUGS-43083: Fix IsIPv4 function identifying also addresses instead…
a35751a 
… of CIDRs

The issue deploying IPv6 disconnected clusters happens on the validation of the KASEndpointSlice (https://github.com/openshift/hypershift/blob/main/control-plane-operator/hostedclusterconfigoperator/controllers/resources/kas/reconcile.go\#L32). Now that function supports IPv4/IPv6 addresses too, so the workflow is not modified but the validation and configuration of the Kubernetes endpointSlice

Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>
@jparrill
Copy link
Contributor Author

/retest

@muraee
Copy link
Contributor

muraee commented Dec 17, 2024

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 17, 2024
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD ef8596d and 2 for PR HEAD a35751a in total

@jparrill
Copy link
Contributor Author

/retest-required

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 68f7ab0 and 1 for PR HEAD a35751a in total

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 59e208a and 0 for PR HEAD a35751a in total

@openshift-ci-robot
Copy link

/hold

Revision a35751a was retested 3 times: holding

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 18, 2024
@jparrill
Copy link
Contributor Author

/hold cancel

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 18, 2024
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 59e208a and 2 for PR HEAD a35751a in total

enxebre
enxebre reviewed Dec 18, 2024
View reviewed changes
ignition-server/cmd/start.go
@@ -149,6 +149,10 @@ func setUpPayloadStoreReconciler(ctx context.Context, registryOverrides map[stri
return nil, fmt.Errorf("unable to create image file cache: %w", err)
}

imageMetaDataProvider := &util.RegistryClientImageMetadataProvider{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why does the ignition-server needs the new metadata provider? Isn't this which is already available all we need https://github.com/openshift/hypershift/blob/main/ignition-server/cmd/start.go#L155-L165? so the you can invoke GetOpenShiftImageRegistryOverrides?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The releaseProvider does not contain the ImageMetadata of the Release image itself, but the content. And to verify the Arch functions will need all the metadata including the layers.

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Dec 18, 2024

@jparrill: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-override 04fe356 link true /test e2e-aws-override
ci/prow/okd-scos-e2e-aws-ovn a35751a link false /test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit 3fddc32 into openshift:main Dec 18, 2024
14 of 15 checks passed
@openshift-ci-robot
Copy link

@jparrill: Jira Issue OCPBUGS-44655: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-44655 has been moved to the MODIFIED state.

Jira Issue OCPBUGS-43083: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-43083 has been moved to the MODIFIED state.

In response to this:

The issue with the MultiArch check is that it's recovering the manifests without passing through ImageMetadaProvider. I've added a new method to that which recovers the requested manifest and adds it to a new LRU Cache.

To pass the ImageMetadataProvider to the RegistryClient, implies to fall in a import cycle issue, so a new interface was created called ManifestProvider, which implement the same GetManifest methods as the original does.

Which issue(s) this PR fixes:
Fixes:

  • OCPBUGS-44655 - HO issue determining the cluster payload arch does not checks the ICSP/IDMS
  • OCPBUGS-43083 - Pods cannot connect to apiserver in IPv6 disconnected hosted cluster

Issues Solved

  • Detecting MultiArch cannot get the right manifest (original GetManifests is not using the ImageMetadataProvider)
  • Implemented GetManifests method inside of ImageMetadataProvider
  • ImageMetadataProvider does not understand the IDMS with only the domain (exact match works fine
  • Patched GetOverrideImages to understand IDMS namespace wildcards
  • CVO is being override by a EnvVar and not getting the digest from OCP release
  • Implemented GetDigest method inside of ImageMetadataProvider
  • CVO deployment’s payload-script does not contain EOF
  • IPv6 does not work, nodes cannot join the KAS
  • The IsIPv4 function now accepts IPAddresses instead of only CIDRs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jparrill
Copy link
Contributor Author

/cherry-pick release-4.18

@openshift-cherrypick-robot
Copy link

@jparrill: #5168 failed to apply on top of branch "release-4.18":

Applying: OCPBUGS-44655: Fix multiarch validations using MetadataProvider
Using index info to reconstruct a base tree...
M	cmd/cluster/core/create.go
M	cmd/cluster/core/create_test.go
M	control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go
M	control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
M	control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
M	control-plane-operator/controllers/hostedcontrolplane/olm/catalogs.go
M	control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents.yaml
M	control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go
M	control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
M	control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources_test.go
M	hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go
M	hypershift-operator/controllers/nodepool/secret_janitor_test.go
M	support/util/util.go
Falling back to patching base and 3-way merge...
Auto-merging support/util/util.go
Auto-merging hypershift-operator/controllers/nodepool/secret_janitor_test.go
CONFLICT (content): Merge conflict in hypershift-operator/controllers/nodepool/secret_janitor_test.go
Auto-merging hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go
Auto-merging control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources_test.go
Auto-merging control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go
CONFLICT (content): Merge conflict in control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents.yaml
Auto-merging control-plane-operator/controllers/hostedcontrolplane/olm/catalogs.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
CONFLICT (content): Merge conflict in control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
Auto-merging control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go
CONFLICT (content): Merge conflict in control-plane-operator/controllers/hostedcontrolplane/cvo/reconcile.go
Auto-merging cmd/cluster/core/create_test.go
Auto-merging cmd/cluster/core/create.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 OCPBUGS-44655: Fix multiarch validations using MetadataProvider

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-bot
Copy link

[ART PR BUILD NOTIFIER]

Distgit: hypershift
This PR has been included in build ose-hypershift-container-v4.19.0-202412181337.p0.g3fddc32.assembly.stream.el9.
All builds following this will include this PR.

This was referenced Dec 19, 2024
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@muraee muraee muraee left review comments

@csrwng csrwng csrwng left review comments

@enxebre enxebre enxebre left review comments

@hasueki hasueki Awaiting requested review from hasueki

@sjenning sjenning Awaiting requested review from sjenning

Assignees

@csrwng csrwng

@muraee muraee

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release area/testing Indicates the PR includes changes for e2e testing jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@jparrill @openshift-ci-robot @csrwng @muraee @openshift-cherrypick-robot @openshift-bot @enxebre @openshift-merge-robot