Remove reject ACLs regardless of cache

[trozet]

Previously we were just checking if there as a known ACL which existed
in the cache. If the cache is ever out of sync, we could accidentally
leave stale reject ACLs configured in OVN.

This patch adds checking during service sync for any known stale ACLs
with reject actions belonging to a service. During regular reject ACL
delete a new check is added to see if cache is in an invalid state, and
if so attempt to remove the ACL by querying OVN.

Signed-off-by: Tim Rozet trozet@redhat.com

[trozet]

/hold

Want to test this more and maybe also add another commit for handling stale ACL removal in syncServices.

[dcbw]

If we have to do some kind of "sync OVN database to Kube API state" when ovnkube restarts, we should do that in the sync functions if possible.

[trozet]

If we have to do some kind of "sync OVN database to Kube API state" when ovnkube restarts, we should do that in the sync functions if possible.

@dcbw I added some handling in the services sync function. This is a little tricky because these are ACLs, so we can't be 100% sure that they belong to services unless the name matches. Therefore I only blow those away if I can tell that they have the expected name of a service and are stale (aka have endpoints). I fixed the regular delete operation to use the cache. However, when we can tell the cache is in an invalid state, last resort is still to try to query OVN.

[trozet]

running downstream on openshift/ovn-kubernetes#295

[coveralls]

Coverage increased (+0.1%) to 56.35% when pulling 3e00ff5 on trozet:fix_reject_acl_removal into 273400a on ovn-org:master.

[dcbw]

/lgtm
but the testcase failures both seem service-related; do you think they are relevant?

[trozet]

/lgtm
but the testcase failures both seem service-related; do you think they are relevant?

I didn't look closely. I saw there were a few flakes, and that's about what we usually get out of our CI these days 🥇

Let's see what the next round of CI results bring.

[trozet]

I think CI looks OK. These changes aren't IPv6 or shared gw specific.