ACL Indexes Merge Downstream: 31st May 2023#1684
Closed
tssurya wants to merge 18 commits intoopenshift:masterfrom
Closed
ACL Indexes Merge Downstream: 31st May 2023#1684tssurya wants to merge 18 commits intoopenshift:masterfrom
tssurya wants to merge 18 commits intoopenshift:masterfrom
Conversation
which mean reset, not ignore. When acls are updated on initial sync (by handling add events) if namespace log levels were reset, acls should also be updated with nil Severity. Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
intention from implementation. Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Add new BuildACLFromDbIDs function, that should be the only one used in the end of acls indexes update. Add 2 owner Types for global and namespaced multicast resources. Generate ACL name based on dbIDs, don't include owner information to save some symbols. Add (objectIDs *DbObjectIDs) StringNoOwner() for this purpose. Add cleanup function for disabled multicast support and namespaced multicast cleanup. Move noneMatch to the gress_policy.go, where it is used. Add tests for multicast acl sync and cleanup. Rename address_set_syncer package to external_ids_syncer, add acl syncer sub-package. Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
1. Use dbIDs with new NetpolNodeOwnerType 2. Add aclSync for allow from node ACL 3. Rework AllowFromNode ACL unit tests to run everything for ipv4 and ipv6 Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Move gress-related constants from policy.go to gress_policy.go. Use old externalIDs for syncs only. policy test "correctly retries recreating a network policy with the same name" last expected data was updated, since newly generated ACLs Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Add NetpolNamespaceOwnerType for namespace-wide default deny acls. Add acl_sync PrimaryID check to make sure in case more than 1 ACLs have the same primaryID, only of them will be updated. This also eliminates the need for "deleting a network policy that failed half-way through creation succeeds" test, which is based on a "found multiple results for provided predicate" condition. Replace tests "stale ACLs should be cleaned up or updated at startup via syncNetworkPolicies" and "ACLs with long names and run syncNetworkPolicies" with the new "reconciles an existing networkPolicy updating stale ACLs with long names", and a part that deletes stale ARP ACLs is now updated and tested as a part of acl_sync. Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Add EgressFirewallOwnerType for egress firewall ACLs. Update syncEgressFirewall to use passed egressFirewalls objects for cleanup, create updateEgressFirewallACLsDbIndex function that updates old formatted ACLs. Update egressfirewall_test.go, move a part of setup to BeforeEach. Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
1. rename BuildACLFromDbIndex to BuildACL, since it is the only method that should be used now. 2. Rename getACLMatchFromACLDir to getACLMatch, remove stale version. 3. update isEquivalentACL to checkACLPrimaryID, that matches on primaryID until we get client indexes. 4. Add acls.md doc explaining all acls that are used by ovn-k and their dependencies with examples 5. Update multicast docs Add missing links to README.md Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Now Egress firewall ACLs are named "EF:<namespace>:<priority>" default deny netpol ACLs "NP:<namespace>:<direction>" gress ACLs "NP:<policyNamespace>:<policyName>:<direction>:<gressIdx>" Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Acls new indexes
Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
…once Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
…t that. Spotted in upstream ovn-org/ovn CI when running against ovn versions <=22.09 which don't support component templates: https://github.com/ovn-org/ovn/actions/runs/4628617882 Reported error: failed to sync chassis: error: failed to get template var list: error: Wrong parameter type (*nbdb.ChassisTemplateVar): Model not found in Database Model Fixes: 4b3475a ("services: Use OVN template load balancers for NodePort services.") Signed-off-by: Dumitru Ceara <dceara@redhat.com>
services: Don't try to list/cleanup templates when OVN doesn't suppor…
Minor performance fixes
Use PrimaryID as a client index for ACL.
openshift-ci
bot
added
the
do-not-merge/hold
…cl-indexes-merge-downstream Conflicts: go-controller/pkg/libovsdb/libovsdb.go because openshift#1652 is merged already
tssurya
force-pushed
the
acl-indexes-merge-downstream
branch
from
331f2b2 to
2f2bc32
Compare
Contributor
Author
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
Contributor
Author
|
/retest unit |
Contributor
|
@tssurya: The
The following commands are available to trigger optional jobs:
Use
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Contributor
Author
|
/test unit |
1 similar comment
Contributor
Author
|
/test unit |
Contributor
Author
|
unit test will fail till we get ovn-kubernetes/ovn-kubernetes#3505 in, I can get that in only when this merges since we don't want to disrupt merge order, so we are going to have to override that job :/ |
Contributor
Author
|
/test unit |
Contributor
Author
|
/test unit |
Contributor
Author
|
/retest |
Contributor
Author
|
/payload 4.14 nightly informing |
Contributor
|
@tssurya: trigger 55 job(s) of type informing for the nightly release of OCP 4.14
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/5619f840-ff81-11ed-9b89-6c0cf7df2d1e-0 |
Contributor
Author
|
/payload-abort |
Contributor
Contributor
Author
|
/payload-aggregate periodic-ci-openshift-release-master-ci-4.14-e2e-gcp-ovn-upgrade 5 |
Contributor
|
@tssurya: trigger 1 job(s) for the /payload-(job|aggregate) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/173d7b50-ff82-11ed-89b0-105077cde5d5-0 |
Contributor
|
/lgtm for conflicts around #1652 |
Contributor
Author
|
/test e2e-aws-ovn-hypershift |
Contributor
|
/lgtm |
Contributor
Author
|
/hold |
openshift-ci
bot
added
lgtm
Contributor
|
/approve |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jcaamano, npinaeva, tssurya The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
Contributor
Author
|
/test e2e-aws-ovn-windows |
Contributor
Author
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
Contributor
Author
|
/test e2e-aws-ovn-windows |
Contributor
Author
|
/test e2e-vsphere-windows |
Contributor
Author
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
Contributor
Author
|
don't remove hold here, we want to prioritize #1690 |
Contributor
|
@tssurya: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Contributor
Author
|
closed in favour of #1692 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.