OCPBUGS-58501,OCPBUGS-59657,OCPBUGS-42303,OCPBUGS-61566: DownStream Merge [09-09-2025]

.github/actions/free-disk-space/action.yml

@@ -0,0 +1,43 @@
+name: Free Disk Space
+description: Reclaims disk space on GitHub-hosted runners
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        echo "=== Disk usage before cleanup ==="
+        df -h
+
+        echo "=== Remove Android SDK ==="
+        sudo rm -rf /usr/local/lib/android/sdk
+
+        echo "=== Apt cleanup ==="
+        sudo apt-get update
+        if command -v eatmydata >/dev/null 2>&1; then
+          SUDO_EAT="sudo eatmydata"
+        else
+          echo "eatmydata not found – falling back to plain apt-get"
+          SUDO_EAT="sudo"
+        fi
+        $SUDO_EAT apt-get purge --auto-remove -y \
+          azure-cli firefox google-chrome-stable 'llvm-*' microsoft-edge-stable powershell 'temurin-*' 'zulu-*' || true
+
+        sudo apt-get autoclean
+        sudo apt-get autoremove -y
+        sudo apt-get clean
+
+        echo "=== Docker cleanup ==="
+        sudo docker system prune -af --volumes
+
+        echo "=== Disable and remove swap ==="
+        sudo swapon --show
+        sudo swapoff -a || true    # ignore error when no swap is present
+        sudo rm -f /mnt/swapfile
+
+        echo "=== Remove potential leftover PV setup image ==="
+        sudo rm -f /mnt/tmp-pv.img
+
+        echo "=== Disk usage after cleanup ==="
+        df -h
+

.github/workflows/test.yml

@@ -295,6 +295,7 @@ jobs:
       OVN_GATEWAY_MODE: "${{ matrix.gateway-mode }}"
       OVN_MULTICAST_ENABLE:  "false"
     steps:
+
     - name: Check out code into the Go module directory - from Master branch
       uses: actions/checkout@v4
       with:
@@ -317,27 +318,11 @@ jobs:
         echo "GOPATH=$GOPATH" >> $GITHUB_ENV
         echo "$GOPATH/bin" >> $GITHUB_PATH
 
+    - name: Check out code into the Go module directory - from PR branch
+      uses: actions/checkout@v4
+
     - name: Free up disk space
-      run: |
-        df -h
-        sudo rm -rf /usr/local/lib/android/sdk
-        sudo apt-get update
-        sudo eatmydata apt-get purge --auto-remove -y \
-          azure-cli firefox \
-          google-chrome-stable \
-          llvm-* microsoft-edge-stable \
-          powershell temurin-* zulu-*
-        # clean unused packages
-        sudo apt-get autoclean
-        sudo apt-get autoremove -y
-        # clean apt cache
-        sudo apt-get clean
-        sudo docker system prune -af --volumes
-        df -h
-        sudo swapon --show
-        sudo swapoff -a
-        sudo rm -f /mnt/swapfile
-        df -h
+      uses: ./.github/actions/free-disk-space
 
     - name: Download test-image-master
       uses: actions/download-artifact@v4
@@ -386,9 +371,6 @@ jobs:
       run: |
         docker load --input ${CI_IMAGE_PR_TAR} && rm -rf ${CI_IMAGE_PR_TAR}
 
-    - name: Check out code into the Go module directory - from PR branch
-      uses: actions/checkout@v4
-
     - name: Runner Diagnostics
       if: always()
       uses: ./.github/actions/diagnostics
@@ -462,7 +444,7 @@ jobs:
           - {"target": "control-plane",     "ha": "noHA", "gateway-mode": "local",  "ipfamily": "ipv6",      "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"}
           - {"target": "control-plane",     "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "2br", "ic": "ic-single-node-zones"}
           - {"target": "control-plane",     "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv6",      "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "2br", "ic": "ic-single-node-zones", "cni-mode": "unprivileged"}
-          - {"target": "multi-homing",      "ha": "noHA", "gateway-mode": "local",  "ipfamily": "ipv4",      "disable-snat-multiple-gws": "SnatGW",   "second-bridge": "1br", "ic": "ic-disabled"}
+          - {"target": "multi-homing",      "ha": "noHA", "gateway-mode": "shared",  "ipfamily": "dualstack",      "disable-snat-multiple-gws": "SnatGW",   "second-bridge": "1br", "ic": "ic-single-node-zones"}
           - {"target": "multi-homing-helm", "ha": "HA",   "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "snatGW",   "second-bridge": "1br", "ic": "ic-disabled", "network-segmentation": "enable-network-segmentation"}
           - {"target": "node-ip-mac-migration", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv6",      "disable-snat-multiple-gws": "SnatGW",   "second-bridge": "1br", "ic": "ic-disabled"}
           - {"target": "node-ip-mac-migration", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "SnatGW",   "second-bridge": "1br", "ic": "ic-single-node-zones"}
@@ -483,6 +465,7 @@ jobs:
           - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv6", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"}
           - {"target": "bgp", "ha": "noHA", "gateway-mode": "local",  "ipfamily": "dualstack", "disable-snat-multiple-gws": "snatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "routeadvertisements": "advertise-default", "network-segmentation": "enable-network-segmentation", "dns-name-resolver": "enable-dns-name-resolver"}
           - {"target": "bgp", "ha": "noHA", "gateway-mode": "shared",  "ipfamily": "dualstack", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "routeadvertisements": "advertise-default", "network-segmentation": "enable-network-segmentation", "dns-name-resolver": "enable-dns-name-resolver"}
+          - {"target": "bgp", "ha": "noHA", "gateway-mode": "local",  "ipfamily": "ipv6", "disable-snat-multiple-gws": "snatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "routeadvertisements": "advertise-default", "network-segmentation": "enable-network-segmentation"}
           - {"target": "bgp-loose-isolation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "dualstack", "disable-snat-multiple-gws": "snatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "routeadvertisements": "advertise-default", "network-segmentation": "enable-network-segmentation", "advertised-udn-isolation-mode": "loose"}
           - {"target": "traffic-flow-test-only","ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "traffic-flow-tests": "1-24", "network-segmentation": "enable-network-segmentation"}
           - {"target": "tools", "ha": "noHA", "gateway-mode": "local", "ipfamily": "dualstack", "disable-snat-multiple-gws": "SnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "network-segmentation": "enable-network-segmentation"}
@@ -518,6 +501,12 @@ jobs:
       ADVERTISED_UDN_ISOLATION_MODE: "${{ matrix.advertised-udn-isolation-mode }}"
       OVN_UNPRIVILEGED_MODE: "${{ matrix.cni-mode == 'unprivileged' }}"
     steps:
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v4
+
+    - name: Runner Diagnostics
+      if: always()
+      uses: ./.github/actions/diagnostics
 
     - name: Install VRF kernel module
       run: |
@@ -527,26 +516,7 @@ jobs:
         sudo modprobe vrf
 
     - name: Free up disk space
-      run: |
-        df -h
-        sudo rm -rf /usr/local/lib/android/sdk
-        sudo apt-get update
-        sudo eatmydata apt-get purge --auto-remove -y \
-          azure-cli firefox \
-          google-chrome-stable \
-          llvm-* microsoft-edge-stable \
-          powershell temurin-* zulu-*
-        # clean unused packages
-        sudo apt-get autoclean
-        sudo apt-get autoremove -y
-        # clean apt cache
-        sudo apt-get clean
-        sudo docker system prune -af --volumes
-        df -h
-        sudo swapon --show
-        sudo swapoff -a
-        sudo rm -f /mnt/swapfile
-        df -h
+      uses: ./.github/actions/free-disk-space
 
     - name: Setup /mnt/runner directory
       run: |
@@ -566,9 +536,6 @@ jobs:
         sudo systemctl start docker docker.socket
         docker system info
 
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
-
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
@@ -741,9 +708,14 @@ jobs:
       KIND_NUM_ZONES: "${{ matrix.num-zones }}"
       KIND_NUM_NODES_PER_ZONE: "${{ matrix.num-nodes-per-zone }}"
     steps:
+
     - name: Check out code into the Go module directory
       uses: actions/checkout@v4
 
+    - name: Runner Diagnostics
+      if: always()
+      uses: ./.github/actions/diagnostics
+
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
@@ -762,26 +734,7 @@ jobs:
         echo "$GOPATH/bin" >> $GITHUB_PATH
 
     - name: Free up disk space
-      run: |
-        df -h
-        sudo rm -rf /usr/local/lib/android/sdk
-        sudo apt-get update
-        sudo eatmydata apt-get purge --auto-remove -y \
-          azure-cli firefox \
-          google-chrome-stable \
-          llvm-* microsoft-edge-stable \
-          powershell temurin-* zulu-*
-        # clean unused packages
-        sudo apt-get autoclean
-        sudo apt-get autoremove -y
-        # clean apt cache
-        sudo apt-get clean
-        sudo docker system prune -af --volumes
-        df -h
-        sudo swapon --show
-        sudo swapoff -a
-        sudo rm -f /mnt/swapfile
-        df -h
+      uses: ./.github/actions/free-disk-space
 
     - name: Disable ufw
       # For IPv6 and Dualstack, ufw (Uncomplicated Firewall) should be disabled.

MAINTAINERS.md

@@ -4,9 +4,9 @@ The current Maintainers Group for the ovn-kubernetes Project consists of:
 | ---- | -------- | ---------------- |
 | [Girish Moodalbail](https://github.com/girishmg) | NVIDIA | All things ovnkube |
 | [Jaime Caamaño Ruiz](https://github.com/jcaamano) | Red Hat | All things ovnkube |
-| [Nadia Pinaeva](https://github.com/npinaeva) | Red Hat  | All things ovnkube |
+| [Nadia Pinaeva](https://github.com/npinaeva) | NVIDIA  | All things ovnkube |
 | [Surya Seetharaman](https://github.com/tssurya)   | Red Hat | All things ovnkube |
-| [Tim Rozet](https://github.com/trozet)   | Red Hat | All things ovnkube |
+| [Tim Rozet](https://github.com/trozet)   | NVIDIA | All things ovnkube |
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for general contribution guidelines.
 See [GOVERNANCE.md](./GOVERNANCE.md) for governance guidelines and maintainer responsibilities.

contrib/kind-common

@@ -440,7 +440,7 @@ install_cert_manager() {
 
 install_kubevirt_ipam_controller() {
   echo "Installing KubeVirt IPAM controller manager ..."
-  manifest="https://github.com/kubevirt/ipam-extensions/releases/download/v0.3.0/install.yaml"
+  manifest="https://github.com/kubevirt/ipam-extensions/releases/download/v0.3.1/install.yaml"
   run_kubectl apply -f "$manifest"
   kubectl wait -n kubevirt-ipam-controller-system deployment kubevirt-ipam-controller-manager --for condition=Available --timeout 2m
 }

dist/images/ovnkube.sh

@@ -418,6 +418,19 @@ wait_for_event() {
   done
 }
 
+# wait_ovnkube_controller_with_node_done - Wait for ovnkube-controller-with-node process to complete
+# Checks if the ovnkube-controller-with-node process is running by looking for its PID file.
+# If the PID file exists, waits for that process to finish before continuing.
+# If the PID file doesnt exist, it means the process has already exited.
+wait_ovnkube_controller_with_node_done() {
+  local pid_file=${OVN_RUNDIR}/ovnkube-controller-with-node.pid
+   if [[ -f ${pid_file} ]]; then
+     echo "info: waiting on ovnkube-controller-with-node process to end"
+     wait $(cat $pid_file)
+     echo "info: done waiting for ovn-controller-with-node to end"
+  fi
+}
+
 # The ovnkube-db kubernetes service must be populated with OVN DB service endpoints
 # before various OVN K8s containers can come up. This functions checks for that.
 # If OVN dbs are configured to listen only on unix sockets, then there will not be
@@ -492,6 +505,36 @@ ovs_ready() {
   return 0
 }
 
+# get_bridge_name_for_physnet - Extract OVS bridge name for a given OVN physical network
+# Takes an OVN network name for physical networks (physnet) and returns the corresponding
+# OVS bridge name from the ovn-bridge-mappings configuration.
+# Return empty string if not found.
+get_bridge_name_for_physnet() {
+      local physnet="$1"
+      local mappings
+      mappings=$(ovs-vsctl --if-exists get open_vswitch . external_ids:ovn-bridge-mappings)
+      # Extract bridge name after physnet: and before next comma (or end)
+      # regex matches zero or more non-comma characters
+      # cut on colon and return field number 2
+      echo "$mappings" | tr -d "\"" | grep -o "$physnet:[^,]*" | cut -d: -f2
+}
+
+# Adds drop flows for GARPs on patch port to br-int for specified bridge.
+add_garp_drop_flow() {
+    local bridge="$1"
+    local cookie="0x0305"
+    local priority="498"
+    # if bridge exists, and the patch port is created, we expect to add at least one flow to a patch port ending in to-br-int.
+    # FIXME: can we generate the exact name. Its possible we add these flows to the incorrect port when selecting on substring
+    for port_name in $(ovs-vsctl list-ports $bridge); do
+        if [[ "$port_name" == *to-br-int ]]; then
+            local of_port=$(ovs-vsctl get interface $port_name ofport)
+            ovs-ofctl add-flow $bridge "cookie=$cookie,table=0,priority=$priority,in_port=$of_port,arp,arp_op=1,actions=drop" > /dev/null
+            break
+        fi
+    done
+}
+
 # Verify that the process is running either by checking for the PID in `ps` output
 # or by using `ovs-appctl` utility for the processes that support it.
 # $1 is the name of the process
@@ -1732,7 +1775,10 @@ ovnkube-controller() {
 }
 
 ovnkube-controller-with-node() {
-  trap 'kill $(jobs -p) ; rm -f /etc/cni/net.d/10-ovn-kubernetes.conf ; exit 0' TERM
+  # send sig term to background job (ovnkube-node process), remove CNI conf and resume background job until it ends.
+  # currently we the process to background, therefore wait until that process removes its pid file on exit.
+  # if the pid file doesnt exist, we exit immediately.
+  trap 'kill $(jobs -p) ; rm -f /etc/cni/net.d/10-ovn-kubernetes.conf ; wait_ovnkube_controller_with_node_done; exit 0' TERM
   check_ovn_daemonset_version "1.1.0"
   rm -f ${OVN_RUNDIR}/ovnkube-controller-with-node.pid
 
@@ -1757,6 +1803,23 @@ ovnkube-controller-with-node() {
     wait_for_event process_ready ovn-controller
   fi
 
+  # start temp work around
+  # remove when https://issues.redhat.com/browse/FDP-1537 is avilable
+  if [[ ${ovnkube_node_mode} == "full" && ${ovn_enable_interconnect} == "true" && ${ovn_egressip_enable} == "true" ]]; then
+    echo "=============== ovnkube-controller-with-node - (add GARP drop flows if external bridge exists)"
+    # bridge may not yet exist
+    local bridge_name="$(get_bridge_name_for_physnet 'physnet')"
+    if [[ "$bridge_name" != "" ]]; then
+      echo "=============== ovnkube-controller-with-node - found bridge mapping for physnet: $bridge_name"
+      # nothing to do if the external bridge isn't created.
+      if ovs-vsctl br-exists $bridge_name; then
+        echo "=============== ovnkube-controller-with-node - found bridge $bridge_name"
+        add_garp_drop_flow "$bridge_name"
+        echo "=============== ovnkube-controller-with-node - (finished adding GARP drop flows)"
+      fi
+    fi
+  fi
+
   ovn_routable_mtu_flag=
   if [[ -n "${routable_mtu}" ]]; then
     routable_mtu_flag="--routable-mtu ${routable_mtu}"

docs/features/user-defined-networks/user-defined-networks.md

@@ -58,11 +58,11 @@ This feature is enabled by default on all OVN-Kubernetes clusters.
 You don't need to do anything extra to start using this feature.
 There is a Feature Config option `--enable-network-segmentation` under
 `OVNKubernetesFeatureConfig` config that can be used to disable this
-feature. However note that disabling the feature will not remove
+feature. However, note that disabling the feature will not remove
 existing CRs in the cluster. This feature has to be enabled along with
 the flag for multiple-networks `--enable-multi-network` since UDNs
 use Network Attachment Definitions as underlying implementation detail
-construct and reuse the secondary network controllers.
+construct and reuse the user-defined network controllers.
 
 ## Workflow Description
 
@@ -339,7 +339,7 @@ default `eth0` interface of the pods:
 _uuid               : 1278b0f4-0a14-4637-9d05-83ba9df6ec03
 action              : allow
 direction           : from-lport
-external_ids        : {direction=Egress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:AllowHostARPSecondary:Egress", "k8s.ovn.org/name"=AllowHostARPSecondary, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
+external_ids        : {direction=Egress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:AllowHostARPPrimaryUDN:Egress", "k8s.ovn.org/name"=AllowHostARPPrimaryUDN, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
 label               : 0
 log                 : false
 match               : "inport == @a8747502060113802905 && (( arp && arp.tpa == 10.244.2.2 ) || ( nd && nd.target == fd00:10:244:3::2 ))"
@@ -355,7 +355,7 @@ tier                : 0
 _uuid               : 489ae95b-ae9d-47d0-bf1d-b2477a9ed6a2
 action              : allow
 direction           : to-lport
-external_ids        : {direction=Ingress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:AllowHostARPSecondary:Ingress", "k8s.ovn.org/name"=AllowHostARPSecondary, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
+external_ids        : {direction=Ingress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:AllowHostARPPrimaryUDN:Ingress", "k8s.ovn.org/name"=AllowHostARPPrimaryUDN, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
 label               : 0
 log                 : false
 match               : "outport == @a8747502060113802905 && (( arp && arp.spa == 10.244.2.2 ) || ( nd && nd.target == fd00:10:244:3::2 ))"
@@ -372,7 +372,7 @@ tier                : 0
 _uuid               : 980be3e4-75af-45f7-bce3-3bb08ecd8b3a
 action              : drop
 direction           : to-lport
-external_ids        : {direction=Ingress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:DenySecondary:Ingress", "k8s.ovn.org/name"=DenySecondary, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
+external_ids        : {direction=Ingress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:DenyPrimaryUDN:Ingress", "k8s.ovn.org/name"=DenyPrimaryUDN, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
 label               : 0
 log                 : false
 match               : "outport == @a8747502060113802905"
@@ -388,7 +388,7 @@ tier                : 0
 _uuid               : cca19dca-1fde-4a14-841d-7e2cce804de4
 action              : drop
 direction           : from-lport
-external_ids        : {direction=Egress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:DenySecondary:Egress", "k8s.ovn.org/name"=DenySecondary, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
+external_ids        : {direction=Egress, "k8s.ovn.org/id"="default-network-controller:UDNIsolation:DenyPrimaryUDN:Egress", "k8s.ovn.org/name"=DenyPrimaryUDN, "k8s.ovn.org/owner-controller"=default-network-controller, "k8s.ovn.org/owner-type"=UDNIsolation}
 label               : 0
 log                 : false
 match               : "inport == @a8747502060113802905"