[DO NOT MERGE] Test: Revert "Remove dead OVN_MULTI_NETWORK_ENABLE template variable" #3032
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -130,8 +130,19 @@ spec: | |
| ovn_v6_masquerade_subnet_opt="--gateway-v6-masquerade-subnet {{.V6MasqueradeSubnet}}" | ||
| fi | ||
|
|
||
| dns_name_resolver_enabled_flag= | ||
| if [[ "{{.DNS_NAME_RESOLVER_ENABLE}}" == "true" ]]; then | ||
| dns_name_resolver_enabled_flag="--enable-dns-name-resolver" | ||
| fi | ||
|
|
||
| persistent_ips_enabled_flag="--enable-persistent-ips" | ||
|
|
||
| # This is needed so that converting clusters from GA to TP | ||
| # will rollout control plane pods as well | ||
| network_segmentation_enabled_flag= | ||
| multi_network_enabled_flag="--enable-multi-network" | ||
| network_segmentation_enabled_flag="--enable-network-segmentation" | ||
|
|
||
| route_advertisements_enable_flag= | ||
| if [[ "{{.OVN_ROUTE_ADVERTISEMENTS_ENABLE}}" == "true" ]]; then | ||
| route_advertisements_enable_flag="--enable-route-advertisements" | ||
|
|
@@ -141,6 +152,22 @@ spec: | |
| if [[ "{{.OVN_EVPN_ENABLE}}" == "true" ]]; then | ||
| evpn_enable_flag="--enable-evpn" | ||
| fi | ||
|
|
||
| preconfigured_udn_addresses_enable_flag="--enable-preconfigured-udn-addresses" | ||
|
|
||
| # Enable multi-network policy if configured (control-plane always full mode) | ||
| multi_network_policy_enabled_flag= | ||
| if [[ "{{.OVN_MULTI_NETWORK_POLICY_ENABLE}}" == "true" ]]; then | ||
| multi_network_policy_enabled_flag="--enable-multi-networkpolicy" | ||
| fi | ||
|
|
||
| # Enable admin network policy if configured (control-plane always full mode) | ||
| admin_network_policy_enabled_flag="--enable-admin-network-policy" | ||
|
|
||
| network_connect_enabled_flag= | ||
| if [[ "{{.OVN_NETWORK_CONNECT_ENABLE}}" == "true" ]]; then | ||
| network_connect_enabled_flag="--enable-network-connect" | ||
| fi | ||
|
|
||
| if [ "{{.OVN_GATEWAY_MODE}}" == "shared" ]; then | ||
| gateway_mode_flags="--gateway-mode shared" | ||
|
|
@@ -173,10 +200,23 @@ spec: | |
| ${ovn_v6_transit_switch_subnet_opt} \ | ||
| ${ovn_v4_masquerade_subnet_opt} \ | ||
| ${ovn_v6_masquerade_subnet_opt} \ | ||
| ${dns_name_resolver_enabled_flag} \ | ||
| ${persistent_ips_enabled_flag} \ | ||
| ${multi_network_enabled_flag} \ | ||
| ${network_segmentation_enabled_flag} \ | ||
| ${gateway_mode_flags} \ | ||
| ${network_connect_enabled_flag} \ | ||
| ${route_advertisements_enable_flag} \ | ||
| ${evpn_enable_flag} \ | ||
| ${preconfigured_udn_addresses_enable_flag} \ | ||
| --enable-egress-ip=true \ | ||
| --enable-egress-firewall=true \ | ||
| --enable-egress-qos=true \ | ||
| --enable-egress-service=true \ | ||
| --enable-multicast \ | ||
| --enable-multi-external-gateway=true \ | ||
| ${multi_network_policy_enabled_flag} \ | ||
| ${admin_network_policy_enabled_flag} | ||
| volumeMounts: | ||
| - mountPath: /run/ovnkube-config/ | ||
| name: ovnkube-config | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -141,6 +141,12 @@ The Network operator needs to make sure that the input configuration doesn't cha | |
|
|
||
| The persisted configuration must **make all defaults explicit**. This protects against inadvertent code changes that could destabilize an existing cluster. | ||
|
|
||
| ### Per-Node Configuration | ||
|
|
||
| For certain specialized deployments (e.g., DPU host nodes), some features need to be disabled on a per-node basis even when enabled cluster-wide. Since ConfigMap values cannot be reliably overridden per-node, the CNO implements per-node feature enforcement through conditional logic in the startup scripts. | ||
|
|
||
| The `OVN_NODE_MODE` environment variable is injected into `ovnkube-node` pods and consumed by the startup script (`008-script-lib.yaml`) to conditionally enable or disable features based on the node's operational mode. This ensures that unsupported features are deterministically disabled on specialized hardware regardless of cluster-wide configuration. | ||
|
|
||
| ## Egress Router | ||
|
|
||
| **Input:** `EgressRouter.network.operator.openshift.io` | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -91,6 +91,26 @@ configuration object (which in turn is copied there from the | |
| configuration) is "`OVNKubernetes`". If the specified network type is | ||
| not "`OVNKubernetes`", the CNO will not render any network plugin. | ||
|
|
||
| ### OVN-Kubernetes Node Modes | ||
|
|
||
| OVN-Kubernetes supports different node operational modes through the `OVN_NODE_MODE` | ||
| environment variable. This allows per-node feature enforcement, particularly for | ||
| specialized hardware like DPU (Data Processing Unit) hosts where certain features | ||
| must be disabled. | ||
|
|
||
| The startup script (`008-script-lib.yaml`) contains conditional logic that adjusts | ||
| feature enablement based on the node mode: | ||
|
|
||
| - **`full` mode (default)**: All features enabled as configured | ||
| - **`dpu-host` mode**: Certain features like egress IP, multicast, multi-network | ||
| policies, and admin network policies are automatically disabled regardless of | ||
| cluster-wide configuration | ||
|
|
||
| This approach was necessary because ConfigMap values (`004-config.yaml`) cannot be | ||
| reliably overridden on a per-node basis, but startup script logic can be conditional. | ||
|
|
||
| For detailed information, see `docs/ovn_node_mode.md`. | ||
|
|
||
| ## Multus | ||
|
|
||
| Multus is deployed as long as `.spec.disableMultiNetwork` is not set. | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
DPU-host multicast disable is bypassed by an unconditional CLI arg.
enable_multicast_flagis cleared fordpu-host(Lines 563-565), but Line 769 still always passes--enable-multicast, so the mode-specific disable never takes effect.Suggested fix
exec /usr/bin/ovnkube \ ${init_ovnkube_controller} \ --init-node "${K8S_NODE}" \ @@ ${dns_name_resolver_enabled_flag} \ ${network_observability_enabled_flag} \ ${enable_multicast_flag} \ --zone ${K8S_NODE} \ ${enable_interconnect_flag} \ - --enable-multicast \ --acl-logging-rate-limit "{{.OVNPolicyAuditRateLimit}}" \Also applies to: 563-565, 766-770
🤖 Prompt for AI Agents