NO-JIRA: DownStream Merge [04-02-2026]#3114
Conversation
Add comprehensive test coverage for ClusterUserDefinedNetwork BGP route import behavior across different transport modes. This verifies that the route import controller correctly handles pod subnet routes based on the network's transport configuration. Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
Signed-off-by: Surya Seetharaman <suryaseetharaman.9@gmail.com>
…s in Layer3 Topology Co-authored-by: Tim Rozet <trozet@nvidia.com> Signed-off-by: Lei Huang <leih@nvidia.com>
When kubelet deletes a pod, the SR-IOV device plugin can re-allocate the same VF before the old pod's CmdDel completes. The old pod's CmdDel shim then runs concurrently with the new pod's CmdAdd shim on the same representor. On the setup side, move LinkSetUp and LinkSetMTU from setupSriovInterface (and DPU's addRepPort) into ConfigureOVS so they run immediately after add-port. This ensures the representor is only brought up once it is on br-int, closing the window where an old pod's CmdDel del-port could interfere. On the teardown side, reorder deletePort to call LinkSetDown before del-port, eliminate the window where a racing CmdAdd could have its link setup undone. Signed-off-by: Yun Zhou <yunz@nvidia.com>
There's more things we can transform and trim off of pod objects to reduce informer cache size and memory usage. Signed-off-by: Tim Rozet <trozet@nvidia.com>
UpdatePodStatus was updating the entire pod status, including all the container statuses. Although the webhook would protect against overwriting the status, it would still cause us to have to get the pod and retry update again if status had changed. This fix allows us to still use the status subresource, but now we can target only the annotations we want to change with patch operations. The JSON patch checks with a test operation to make sure the value we are operating on is the latest value, and retries if not, preserving the previous behavior of making sure multiple writers do not ovewrite each other. When the patch operation fails due to conflict we will get StatusReasonInvalid instead of StatusReasonConflict. So update the retry mechanism to look for either error for pod anno updates. Signed-off-by: Tim Rozet <trozet@nvidia.com>
Add tests to verify pod2pod, pod2service, host2pod, and host2service connectivity work correctly in no-overlay mode, both before and after OVN pod restarts. Key test scenarios: - Pod-to-pod connectivity across different nodes - Host-to-pod connectivity (using host network pod) - Pod-to-service connectivity via ClusterIP - Host-to-service connectivity via ClusterIP - Verify all connectivity persists after ovnkube-node pod restart - Verify no Geneve overlay traffic is captured (traffic should be direct, not encapsulated) Changes: - Add NoOverlay feature flag for test categorization ovnkube-config ConfigMap - Add netshoot image for tcpdump-based traffic capture - Add helper functions: getTcpdumpOnPhysicalIface, checkConnectivityWithoutOverlay Signed-off-by: zhaozhanqi <zzhao@redhat.com>
Signed-off-by: zhaozhanqi <zzhao@redhat.com>
Signed-off-by: zhaozhanqi <zzhao@redhat.com>
Signed-off-by: Ayushi Chouhan <aychouha@aychouha-thinkpadp1gen4i.bengluru.csb> Addressed the comments Signed-off-by: Ayushi Chouhan <aychouha@aychouha-thinkpadp1gen4i.bengluru.csb>
Signed-off-by: Ayushi Chouhan <aychouha@aychouha-thinkpadp1gen4i.bengluru.csb>
…rage These unit tests ensures overlay networks create interconnect resources for multi-zone connectivity, while no-overlay networks remain clean as they rely on BGP-advertised routes instead. Test coverage: - Add test verifying interconnect resources created properly for CUDN with overlay transport. - Add test verifying interconnect resources are not created for CUDN with NoOverlay transport. Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
Fix the RouteAdvertisements controller to populate the toReceive field with pod subnets from all selected no-overlay networks, not just the currently matched network. - Iterate through all selected networks to collect no-overlay pod subnets - Add unit test verifying CUDN pod subnets are included in toReceive Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
Add transport validation for ClusterUserDefinedNetwork (CUDN) resources with no-overlay and EVPN transports in the UDN controller. This validates that required RouteAdvertisements CRs exist and are accepted, setting the TransportAccepted status condition accordingly. Key changes: - Add RouteAdvertisements notifier to UDN controller - Implement transport validation in transport_validation.go - Set TransportAccepted status condition based on transport type: * Default Transport: Always accepted (default) * NoOverlay/EVPN: Validated against RouteAdvertisements CR - Re-queue CUDNs when RouteAdvertisements changes Status conditions set: - TransportAccepted=True (DefaultTransportAccepted) for Default Transport - TransportAccepted=True (NoOverlayTransportAccepted) when RA is accepted - TransportAccepted=False (NoOverlayRouteAdvertisementsIsMissing) when no RA - TransportAccepted=False (NoOverlayRouteAdvertisementsNotAccepted) when RA not accepted - Similar conditions for EVPN transport Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
Signed-off-by: Jaime Caamaño Ruiz <jcaamano@redhat.com>
Add e2e test for default network with no-overlay mode
evpn: fix wrong use of IPv4 GW address on IPv6 ACL
Redesign UI-Left Sidebar Panel
CNC: Fix typo in CRD description
Trim more information from pod informer cache
Overlay mode cudn
randomCUDNSubnets() excluded four second octets (96, 132, 243, 244) but not 88, so it could generate /20 subnets within podman's default 10.88.0.0/16 network, causing EVPN e2e test failures on hosts with the default podman bridge. Add 88 to the hardcoded exclusion list. Signed-off-by: Matteo Dallaglio <mdallagl@redhat.com>
OKEP-5377: Extend Primary UDN/CUDN to Support Multiple Cluster Subnets in Layer3 Topology
CNI: reorder SR-IOV representor lifecycle to prevent CmdAdd/CmdDel race
This commit extracts container and network operations from provider-specific code into shared abstractions that can be reused across different infrastructure providers (kind, openshift etc.). This creates a base provider that embeds common container operations, reducing code duplication and improving maintainability. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
…neration Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
The commit ded349d used framework.CreateTestingNS which doesn't properly propagate pod-security.kubernetes.io labels to test namespace. This updates to use f.CreateNamespace() which correctly handles label propagation. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
|
@tssurya: trigger 5 job(s) of type blocking for the ci release of OCP 4.22
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/5eb05cf0-328d-11f1-809e-f086127feab0-0 trigger 13 job(s) of type blocking for the nightly release of OCP 4.22
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/5eb05cf0-328d-11f1-809e-f086127feab0-1 |
|
#3118 will cause merge pool churn here UGH. |
|
/test 4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade |
|
@jluhrsen: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retest-required |
|
/test e2e-aws-ovn-rhcos10-techpreview |
|
/payload-job periodic-ci-openshift-release-main-ci-4.22-e2e-aws-upgrade-ovn-single-node |
|
@Meina-rh: trigger 12 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/81f88340-3300-11f1-8570-f75a210699aa-0 |
|
[Jira:Node][sig-node] Node non-cnv swap configuration should reject user override of swap settings via KubeletConfig API [OCP-86395] [Suite:openshift/conformance/parallel] - being tracked under https://redhat.atlassian.net/browse/OCPBUGS-81737 |
|
/retest-required |
|
/payload-job periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips |
|
@arkadeepsen: trigger 4 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/6e669760-3330-11f1-86cc-560b890b5c0d-0 |
|
/lgtm |
|
waiting for the CI payload run latest to come back before adding verified |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jluhrsen, tssurya The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/payload-job periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips |
|
@jcaamano: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/269952b0-3362-11f1-897f-efd7644502a8-0 |
|
/payload-job periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips |
|
@jcaamano: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/17059f10-33a9-11f1-9268-a82e7fcbe45a-0 |
openshift-ci-robot
added
the
verified
|
@tssurya: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-merge-bot
Bot
merged commit c118cd4
into
openshift:master
14 participants
📑 Description
Fixes #
Additional Information for reviewers
✅ Checks
How to verify it
Summary by CodeRabbit
Release Notes
New Features
Improvements
Documentation
Tests