OCPBUGS-8506,OCPBUGS-8508,OCPBUGS-8501: [release-4.12] Fix EFW's name truncation logic & make EFW ACLs unique using extIDs by npinaeva · Pull Request #1559 · openshift/ovn-kubernetes

npinaeva · 2023-03-07T15:18:38Z

backport of #1558
Conflicts:
go-controller/pkg/ovn/egressfirewall_test.go -
use hardcoded address set hash names

when the acl name is cropped. That happens when namespace name is longer than 43 symbols. Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com> (cherry picked from commit dafe82b) (cherry picked from commit d74d6ea) Conflicts: go-controller/pkg/ovn/egressfirewall_test.go - use hardcoded address set hash names

This commit adds a test to showcase that since syncEgressFirewall isn't calling libovsdbops.BuildACL directly, we are not truncating ACL names. Note that we really need https://github.com/ovn-org/libovsdb/issues/338 for our test server to start screaming for long names. Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com> (cherry picked from commit d996d0e) (cherry picked from commit e6a85ac)

This commit ensures we truncate names as a precaution also in CreateOrUpdateACLsOps so that our bases are covered since not all code snippets call BuildACL directly Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com> (cherry picked from commit 7bfe50e) (cherry picked from commit 22adda1)

In SetupMaster, we always call CreateOrUpdatePortGroupsOps with empty ACLs and PGs for the cluster-wide port group and cluster-wide-router-PG. This is disruptive during upgrades since momentarily all efw ACLs and multicast ACLs will be wiped out. This commit changes this to first check if the PG already exists, if then no need to do anything. Each of those features are responsible for ensuring ACLs, Ports are good on those PGs they own. NOTE: This bug was an issue for multicast and started being an issue for egf from ovn-kubernetes/ovn-kubernetes@bd29f41 Before that we didn't have ACLs on cluster wide PG. Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com> (cherry picked from commit 935bc55) (cherry picked from commit 7c153b3)

openshift-ci-robot · 2023-03-07T15:18:43Z

@npinaeva: This pull request references Jira Issue OCPBUGS-8501, which is invalid:

expected dependent Jira Issue OCPBUGS-8471 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is New instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

backport of #1558

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-03-07T15:18:52Z

@npinaeva: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Details

In response to this:

OCPBUGS-8501: [release-4.12] Add egress firewall external id to make name+externalIDs unique

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-03-07T15:24:35Z

@npinaeva: This pull request references Jira Issue OCPBUGS-8501, which is invalid:

expected dependent Jira Issue OCPBUGS-8471 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is New instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

backport of #1558
Conflicts:
go-controller/pkg/ovn/egressfirewall_test.go -
use hardcoded address set hash names

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-03-07T15:24:37Z

@npinaeva: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Details

In response to this:

OCPBUGS-8501: [release-4.12] Add egress firewall external id to make name+externalIDs unique

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tssurya · 2023-03-07T15:48:34Z

/retitle OCPBUGS-8506,OCPBUGS-8508,OCPBUGS-8501: [release-4.12] Fix EFW's name truncation logic & make EFW ACLs unique using extIDs

openshift-ci-robot · 2023-03-07T15:49:29Z

@npinaeva: This pull request references Jira Issue OCPBUGS-8506, which is invalid:

expected dependent Jira Issue OCPBUGS-8504 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-8508, which is invalid:

expected dependent Jira Issue OCPBUGS-8505 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-8501, which is invalid:

expected dependent Jira Issue OCPBUGS-8471 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is New instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

backport of #1558
Conflicts:
go-controller/pkg/ovn/egressfirewall_test.go -
use hardcoded address set hash names

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-03-07T15:49:47Z

@npinaeva: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

Details

In response to this:

OCPBUGS-8506,OCPBUGS-8508,OCPBUGS-8501: [release-4.12] Fix EFW's name truncation logic & make EFW ACLs unique using extIDs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tssurya

LGTM.
Waiting on CI

trozet · 2023-03-07T22:17:56Z

/lgtm

trozet · 2023-03-07T22:18:16Z

/label backport-risk-assessed

dcbw · 2023-03-08T14:10:53Z

/test e2e-vsphere-windows

dcbw · 2023-03-08T16:30:06Z

/approve

openshift-ci · 2023-03-08T16:30:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dcbw, npinaeva, trozet, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [dcbw,trozet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dcbw · 2023-03-08T21:03:08Z

/jira refresh

openshift-ci-robot · 2023-03-08T21:03:17Z

@dcbw: This pull request references Jira Issue OCPBUGS-8506, which is invalid:

expected dependent Jira Issue OCPBUGS-8504 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-8508, which is invalid:

expected dependent Jira Issue OCPBUGS-8505 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-8501, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.z) matches configured target version for branch (4.12.z)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-8471 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-8471 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dcbw · 2023-03-09T05:06:59Z

/jira refresh

openshift-ci-robot · 2023-03-09T05:07:03Z

@dcbw: This pull request references Jira Issue OCPBUGS-8506, which is invalid:

expected dependent Jira Issue OCPBUGS-8504 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-8508, which is invalid:

expected dependent Jira Issue OCPBUGS-8505 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

This pull request references Jira Issue OCPBUGS-8501, which is valid.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.z) matches configured target version for branch (4.12.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-8471 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-8471 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

npinaeva · 2023-03-09T16:00:17Z

/jira refresh

openshift-ci-robot · 2023-03-09T16:00:34Z

@npinaeva: This pull request references Jira Issue OCPBUGS-8506, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.z) matches configured target version for branch (4.12.z)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-8504 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-8504 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

This pull request references Jira Issue OCPBUGS-8508, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.z) matches configured target version for branch (4.12.z)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-8505 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-8505 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

This pull request references Jira Issue OCPBUGS-8501, which is valid.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.12.z) matches configured target version for branch (4.12.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-8471 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-8471 targets the "4.13.0" version, which is one of the valid target versions: 4.13.0
bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

npinaeva · 2023-03-09T16:00:58Z

/tide refresh

openshift-ci-robot · 2023-03-09T18:29:08Z

/retest-required

Remaining retests: 0 against base HEAD 0488502 and 2 for PR HEAD eb312de in total

npinaeva · 2023-03-09T20:48:01Z

/retest-required

tssurya · 2023-03-09T21:10:12Z

/test e2e-aws-ovn-upgrade-local-gateway

npinaeva · 2023-03-10T08:16:00Z

/retest-required

abhat · 2023-03-10T14:22:02Z

/override ci/prow/e2e-aws-ovn-local-to-shared-gateway-mode-migration
/override ci/prow/e2e-aws-ovn-shared-to-local-gateway-mode-migration
/override ci/prow/e2e-aws-ovn-upgrade

openshift-ci · 2023-03-10T14:23:24Z

@abhat: Overrode contexts on behalf of abhat: ci/prow/e2e-aws-ovn-local-to-shared-gateway-mode-migration, ci/prow/e2e-aws-ovn-shared-to-local-gateway-mode-migration, ci/prow/e2e-aws-ovn-upgrade

Details

In response to this:

/override ci/prow/e2e-aws-ovn-local-to-shared-gateway-mode-migration
/override ci/prow/e2e-aws-ovn-shared-to-local-gateway-mode-migration
/override ci/prow/e2e-aws-ovn-upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dcbw · 2023-03-10T14:25:14Z

/override ci/prow/e2e-aws-ovn-local-gateway
openshift/kubernetes#1503

/override ci/prow/e2e-aws-ovn-upgrade-local-gateway
infra issues with AWS during install

/override ci/prow/e2e-aws-ovn-upgrade-local-gateway
failure to pull Java images from somewhere during test

openshift-ci · 2023-03-10T14:28:45Z

@dcbw: Overrode contexts on behalf of dcbw: ci/prow/e2e-aws-ovn-local-gateway, ci/prow/e2e-aws-ovn-upgrade-local-gateway

Details

In response to this:

/override ci/prow/e2e-aws-ovn-local-gateway
openshift/kubernetes#1503

/override ci/prow/e2e-aws-ovn-upgrade-local-gateway
infra issues with AWS during install

/override ci/prow/e2e-aws-ovn-upgrade-local-gateway
failure to pull Java images from somewhere during test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dcbw · 2023-03-10T14:29:38Z

/override ci/prow/e2e-gcp-ovn
This is the one that actually has the openjdk pull issues

openshift-ci · 2023-03-10T14:32:03Z

@dcbw: Overrode contexts on behalf of dcbw: ci/prow/e2e-gcp-ovn

Details

In response to this:

/override ci/prow/e2e-gcp-ovn
This is the one that actually has the openjdk pull issues

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dcbw · 2023-03-10T14:32:08Z

/tide refresh

openshift-ci · 2023-03-10T14:32:16Z

@npinaeva: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vsphere-ovn	`eb312de`	link	false	`/test e2e-vsphere-ovn`
ci/prow/e2e-ovn-hybrid-step-registry	`eb312de`	link	false	`/test e2e-ovn-hybrid-step-registry`
ci/prow/e2e-aws-ovn	`eb312de`	link	true	`/test e2e-aws-ovn`
ci/prow/e2e-gcp-ovn	`eb312de`	link	true	`/test e2e-gcp-ovn`
ci/prow/e2e-aws-ovn-upgrade-local-gateway	`eb312de`	link	true	`/test e2e-aws-ovn-upgrade-local-gateway`
ci/prow/e2e-aws-ovn-local-gateway	`eb312de`	link	true	`/test e2e-aws-ovn-local-gateway`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-03-10T14:39:53Z

@npinaeva: Jira Issue OCPBUGS-8506: All pull requests linked via external trackers have merged:

openshift/ovn-kubernetes#1559

Jira Issue OCPBUGS-8506 has been moved to the MODIFIED state.

Jira Issue OCPBUGS-8508: All pull requests linked via external trackers have merged:

openshift/ovn-kubernetes#1559

Jira Issue OCPBUGS-8508 has been moved to the MODIFIED state.

Jira Issue OCPBUGS-8501: All pull requests linked via external trackers have merged:

openshift/ovn-kubernetes#1559

Jira Issue OCPBUGS-8501 has been moved to the MODIFIED state.

Details

In response to this:

backport of #1558
Conflicts:
go-controller/pkg/ovn/egressfirewall_test.go -
use hardcoded address set hash names

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

npinaeva and others added 4 commits March 7, 2023 16:14

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 7, 2023

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Mar 7, 2023

openshift-ci bot requested review from JacobTanenbaum and tssurya March 7, 2023 15:22

openshift-ci bot changed the title ~~OCPBUGS-8501: [release-4.12] Add egress firewall external id to make name+externalIDs unique~~ OCPBUGS-8506,OCPBUGS-8508,OCPBUGS-8501: [release-4.12] Fix EFW's name truncation logic & make EFW ACLs unique using extIDs Mar 7, 2023

openshift-ci-robot added the jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. label Mar 7, 2023

tssurya approved these changes Mar 7, 2023

View reviewed changes

openshift-ci bot assigned trozet Mar 7, 2023

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. labels Mar 7, 2023

openshift-ci bot assigned anuragthehatter, asood-rh, huiran0826, jechen0648, mffiedler, qiowang721 and rbbratta Mar 7, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 8, 2023

openshift-ci bot requested a review from anuragthehatter March 8, 2023 21:03

openshift-merge-robot merged commit 951ab2e into openshift:release-4.12 Mar 10, 2023

npinaeva deleted the ocpbugs-8501 branch March 10, 2023 15:27

Conversation

npinaeva commented Mar 7, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 7, 2023

Uh oh!

openshift-ci bot commented Mar 7, 2023

Uh oh!

openshift-ci-robot commented Mar 7, 2023

Uh oh!

openshift-ci bot commented Mar 7, 2023

Uh oh!

tssurya commented Mar 7, 2023

Uh oh!

openshift-ci-robot commented Mar 7, 2023

Uh oh!

openshift-ci bot commented Mar 7, 2023

Uh oh!

tssurya left a comment

Choose a reason for hiding this comment

Uh oh!

trozet commented Mar 7, 2023

Uh oh!

trozet commented Mar 7, 2023

Uh oh!

dcbw commented Mar 8, 2023

Uh oh!

dcbw commented Mar 8, 2023

Uh oh!

openshift-ci bot commented Mar 8, 2023

Uh oh!

dcbw commented Mar 8, 2023

Uh oh!

openshift-ci-robot commented Mar 8, 2023

Uh oh!

dcbw commented Mar 9, 2023

Uh oh!

openshift-ci-robot commented Mar 9, 2023

Uh oh!

npinaeva commented Mar 9, 2023

Uh oh!

openshift-ci-robot commented Mar 9, 2023

Uh oh!

npinaeva commented Mar 9, 2023

Uh oh!

openshift-ci-robot commented Mar 9, 2023

Uh oh!

npinaeva commented Mar 9, 2023

Uh oh!

tssurya commented Mar 9, 2023

Uh oh!

npinaeva commented Mar 10, 2023

Uh oh!

abhat commented Mar 10, 2023

Uh oh!

openshift-ci bot commented Mar 10, 2023

Uh oh!

dcbw commented Mar 10, 2023

Uh oh!

openshift-ci bot commented Mar 10, 2023

Uh oh!

dcbw commented Mar 10, 2023

Uh oh!

openshift-ci bot commented Mar 10, 2023

Uh oh!

dcbw commented Mar 10, 2023

Uh oh!

openshift-ci bot commented Mar 10, 2023

Uh oh!

openshift-ci-robot commented Mar 10, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants

npinaeva commented Mar 7, 2023 •

edited

Loading