OCPBUGS-77257, OCPBUGS-78094: Branch Sync release-4.22 to release-4.21 [03-23-2026]#3080
Conversation
Recently the golang container image we use was changed due to issues with the image on quay.io. Use the same image for creating the project container images. Signed-off-by: Or Mergi <ormergi@redhat.com>
Recently fedora Dockerfile was mistakenly changed to use the wrong package manager. Use dnf package manager in fedora Dockerfile. Signed-off-by: Or Mergi <ormergi@redhat.com>
When ovnkube-node restarts, it runs syncPodsForUserDefinedNetwork which calls allocatePodIPs. For IPAM-less localnet networks (switches with no subnets), IsNonHostSubnetSwitch returns true, causing allocatePodIPs to return empty string. This prevents the pod from being added to expectedLogicalPorts map, causing deleteStaleLogicalSwitchPorts to delete the LSP. This change add an explicit flag at the subnet allocator to denote that that allocator was created as part of a no host subnet switch, this way code explicitly diferenciates between localnet ipamless and no host subnet since both do no have a subnet but no host subnet do not even have LSPs Signed-off-by: Enrique Llorente <ellorent@redhat.com>
Skip configuring EgressIPs on the bridge when they don't belong to the OVN (primary) network. This prevents conflicts when EgressIPs are assigned to secondary host networks. SyncEgressIP() will clean up existing mistaken configurations during bootup while uprading OVN-K. Uses util.IsOVNNetwork() to check network membership and adds a helper function parseAndValidateEIP() to consolidate validation logic and fix missing packet mark validation. Tests have been added to verify that secondary network IPs are ignored and that existing mistaken configurations are cleaned up. Signed-off-by: Peng Liu <pliu@redhat.com>
…rtised BGP routes For testing nodePort service etp=local for UDN network and default network including scenarios: ETP=Local:UDN pod to the same node nodeport service in same UDN network should work ETP=Local:UDN pod to a different node nodeport service in same UDN network should work ETP=Local:UDN pod to the same node nodeport service in different UDN network should not work ETP=Local:UDN pod to a different node nodeport service in different UDN network should work ETP=Local:UDN pod to the same node nodeport service in default network should not work ETP=Local:UDN pod to a different node nodeport service in default network should work ETP=Local:Default network pod to same node nodeport service in UDN network should not work ETP=Local:Default network pod to different node nodeport service in UDN network should work Signed-off-by: zhaozhanqi <zzhao@redhat.com>
dist: Fix fedora build
OCPBUGS-66235: DownStream Merge [12-19-2025]
When processing an EndpointSlice delete event, if the namespace is deleted before the event is processed, the old code would fail early with a "namespace not found" error from GetActiveNetworkForNamespace before executing delServiceRules. This left stale iptables/nftables rules and OpenFlow rules in place, causing a resource leak. Move the GetActiveNetworkForNamespace call to after delServiceRules and before addServiceRules in DeleteEndpointSlice. This ensures old service rules are always cleaned up, even if the namespace or UDN is deleted during event processing. Add graceful error handling for: - Namespace NotFound: Skip adding new rules (namespace deleted) - InvalidPrimaryNetworkError: Skip adding new rules (UDN deleted) - Other errors: Propagate as before Unit tests added to verify: - delServiceRules executes before network lookup - Graceful handling of namespace/UDN deletion scenarios - Proper error propagation for non-graceful errors Assisted-by: Cline Signed-off-by: Peng Liu <pliu@redhat.com>
…openshift-4.22-ose-ovn-kubernetes OCPBUGS-70058: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.22
node: fix DeleteEndpointSlice namespace deletion race condition
Signed-off-by: Yun Zhou <yunz@nvidia.com>
Add pod-if-name external-ids for pod OVS interface to identify OVS interfaces plumbed by CNI with the same UDN for the same pod. Signed-off-by: Yun Zhou <yunz@nvidia.com>
Signed-off-by: Yun Zhou <yunz@nvidia.com>
Signed-off-by: Yun Zhou <yunz@nvidia.com>
Signed-off-by: Yun Zhou <yunz@nvidia.com>
[retry] Make an exception for pods and retry them infinitely.
support pod with multiple same secondary UDN
Signed-off-by: Yun Zhou <yunz@nvidia.com>
Signed-off-by: Yun Zhou <yunz@nvidia.com>
…dvertisements The ndp.Listen() function uses the interface name for the IPv6 zone identifier. Golang net pkg caches zone name to index mappings, which means the zone can become stale if the interface is recreated in under a minute. This caused unsolicited neighbor advertisements to be sent on the wrong zone which caused them to be dropped by the kernel. Fix by using icmp.ListenPacket directly with the interface index as the zone identifier. Signed-off-by: Patryk Diak <pdiak@redhat.com>
* bump up frr-k8s and frr image versions * change to check frr-k8s-statuscleaner status * update dependencies Signed-off-by: Jean Chen <jechen@redhat.com>
Add one e2e EgressIP cases covering below scenarios: should handle EIP reassignment correctly on namespace label update should handle EIP reassignment correctly on pod label update should handle EIP reassignment correctly on EgressIP object update Signed-off-by: Huiran Wang <huirwang@redhat.com>
docs/multi-homing: support of multiple interfaces in the same network
Use interface index for IPv6 zone when sending unsolicited neighbor advertisements
always set arp sysctl configuration for multiple same network interfaces
To run performance tests we needed to modify the kind cluster setup. Creating infra nodes and installing prometheus is required so we can get metrics about the SUT. Installing and running kube-burner is also required for this new workload. In a follow on PR we will collect pprofs from the test Signed-off-by: jtalerico <joe.talerico@gmail.com>
Needed to change the endpoint we listen on for pprof. It was listening on the pod ip -- instead we should listen on localhost. Signed-off-by: jtalerico <joe.talerico@gmail.com>
add eip e2e cases on ns/pod labels update
|
@arkadeepsen: This pull request references Jira Issue OCPBUGS-77257, which is valid. 7 validation(s) were run on this bug
Requesting review from QA contact: This pull request references Jira Issue OCPBUGS-78094, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jluhrsen: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@kyrtapz PTAL |
|
/lgtm |
|
/verified by @huiran0826 with pre-merge testing of the two bugs |
|
@huiran0826: Jira verification commands are restricted to collaborators for this repo. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/verified by @huiran0826 |
openshift-ci-robot
added
the
verified
|
@huiran0826: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: arkadeepsen, jluhrsen, kyrtapz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/override ci/prow/qe-perfscale-payload-control-plane-6nodes |
|
@kyrtapz: Overrode contexts on behalf of kyrtapz: ci/prow/qe-perfscale-payload-control-plane-6nodes DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/label backport-risk-assessed |
openshift-ci
Bot
added
the
backport-risk-assessed
openshift-ci
Bot
assigned
anuragthehatter,
asood-rh,
barbora137,
huiran0826,
jechen0648,
meinali566,
mffiedler,
qiowang721 and
rbbratta
openshift-merge-bot
Bot
merged commit 0fd9d30
into
openshift:release-4.21
|
@jluhrsen: Jira Issue Verification Checks: Jira Issue OCPBUGS-77257 Jira Issue OCPBUGS-77257 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 Jira Issue Verification Checks: Jira Issue OCPBUGS-78094 Jira Issue OCPBUGS-78094 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
20 participants
Manual sync of release-4.22 → release-4.21, excluding recent commits from PR #3011.
Details
This PR syncs commits from release-4.22 up to commit
eedfcd073(Merge pull request #2978) into release-4.21, intentionally excluding the 91 commits from PR #3011 which merged on March 22, 2026.Excluded Commits
051683259Sync Process
release-4.22up toeedfcd073intorelease-4.21go-controller/pkg/ovn/base_network_controller_pods.go:nadNametonadKeyisNonHostSubnetSwitchmethod declarationgo mod tidyinopenshift/(no changes)go mod vendorand./openshift/hack/update-tests-annotation.shmake lintpassesMerge Conflict Resolution
Two conflicts were resolved in
base_network_controller_pods.go:nadNametonadKey(matching the function parameter)Note: This PR includes an automated sync of test annotations with upstream test changes (
go mod vendor+update-tests-annotation.sh)./ok-to-test