Skip to content

fix(api): [release-4.21] OCPBUGS-84303: add IPv6 OVN join subnet config to prevent dual-stack routing collision #8456

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
orenc1 wants to merge 1 commit into from
Closed

fix(api): [release-4.21] OCPBUGS-84303: add IPv6 OVN join subnet config to prevent dual-stack routing collision #8456

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions api/hypershift/v1beta1/operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,13 +62,23 @@ type ClusterNetworkOperatorSpec struct {
// OVNKubernetesConfig contains OVN-Kubernetes specific configuration options.
// https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L400-L471
// +kubebuilder:validation:XValidation:rule="!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet) || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet != self.ipv4.internalTransitSwitchSubnet", message="internalJoinSubnet and internalTransitSwitchSubnet must not be the same"
// +kubebuilder:validation:XValidation:rule="!has(self.ipv6) || !has(self.ipv6.internalJoinSubnet) || !has(self.ipv6.internalTransitSwitchSubnet) || self.ipv6.internalJoinSubnet != self.ipv6.internalTransitSwitchSubnet", message="IPv6 internalJoinSubnet and internalTransitSwitchSubnet must not be the same"
// +kubebuilder:validation:MinProperties=1
type OVNKubernetesConfig struct {
// ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
// this means no opinions and the default configuration is used. Check individual
// fields within ipv4 for details of default values.
// +optional
IPv4 *OVNIPv4Config `json:"ipv4,omitempty"`

// ipv6 allows users to configure IP settings for IPv6 connections. When omitted,
// this means no opinions and the default configuration is used. Check individual
// fields within ipv6 for details of default values.
// For KubeVirt hosted clusters using dual-stack networking, it is recommended to
// set ipv6.internalJoinSubnet to a value different from the management cluster's
// join subnet (default fd98::/64) to avoid IPv6 routing conflicts.
// +optional
IPv6 OVNIPv6Config `json:"ipv6,omitzero,omitempty"`
}

// OVNIPv4Config contains IPv4-specific configuration options for OVN-Kubernetes.
Expand Down Expand Up @@ -108,6 +118,45 @@ type OVNIPv4Config struct {
InternalJoinSubnet string `json:"internalJoinSubnet,omitempty"`
}

// OVNIPv6Config contains IPv6-specific configuration options for OVN-Kubernetes.
// +kubebuilder:validation:MinProperties=1
type OVNIPv6Config struct {
// internalTransitSwitchSubnet is a v6 subnet in IPv6 CIDR format used internally
// by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
// architecture that connects the cluster routers on each node together to enable
// east west traffic. The subnet chosen should not overlap with other networks
// specified for OVN-Kubernetes as well as other networks used on the host.
// When omitted, this means no opinion and the platform is left to choose a reasonable
// default which is subject to change over time.
// The current default subnet is fd97::/64.
// The subnet must be large enough to accommodate one IP per node in your cluster.
// The value must be in proper IPv6 CIDR format.
// Note that IPv6 dual addresses are not permitted.
// +kubebuilder:validation:MaxLength=48
// +kubebuilder:validation:MinLength=3
// +kubebuilder:validation:XValidation:rule="self.matches('^\\\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:))|(::((:[0-9A-Fa-f]{1,4}){1,7}|:)))\\\\s*/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$')", message="Subnet must be in valid IPv6 CIDR format (e.g., fd97::/64)"
// +kubebuilder:validation:XValidation:rule="self.matches('^.*/[0-9]+$') && int(self.split('/')[1]) <= 125", message="subnet must be in the range /0 to /125 inclusive"
// +optional
InternalTransitSwitchSubnet string `json:"internalTransitSwitchSubnet,omitempty"`
// internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the
// default one is being already used by something else. It must not overlap with
// any other subnet being used by OpenShift or by the node network. The size of the
// subnet must be larger than the number of nodes.
// The current default value is fd98::/64.
// For KubeVirt hosted clusters, if this field is not set, HyperShift will
// automatically use fd99::/64 to avoid collisions with the management cluster's
// default join subnet (fd98::/64).
// The subnet must be large enough to accommodate one IP per node in your cluster.
// The value must be in proper IPv6 CIDR format.
// Note that IPv6 dual addresses are not permitted.
// +kubebuilder:validation:MaxLength=48
// +kubebuilder:validation:MinLength=3
// +kubebuilder:validation:XValidation:rule="self.matches('^\\\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:))|(::((:[0-9A-Fa-f]{1,4}){1,7}|:)))\\\\s*/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$')", message="Subnet must be in valid IPv6 CIDR format (e.g., fd98::/64)"
// +kubebuilder:validation:XValidation:rule="self.matches('^.*/[0-9]+$') && int(self.split('/')[1]) <= 125", message="subnet must be in the range /0 to /125 inclusive"
// +optional
InternalJoinSubnet string `json:"internalJoinSubnet,omitempty"`
}

// IngressOperatorSpec is the specification of the desired behavior of the Ingress Operator.
type IngressOperatorSpec struct {
// endpointPublishingStrategy is used to publish the default ingress controller endpoints.
Expand Down
16 changes: 16 additions & 0 deletions api/hypershift/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

64 changes: 64 additions & 0 deletions ...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2908,13 +2908,77 @@ spec:
rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
> 0
type: object
ipv6:
description: |-
ipv6 allows users to configure IP settings for IPv6 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv6 for details of default values.
For KubeVirt hosted clusters using dual-stack networking, it is recommended to
set ipv6.internalJoinSubnet to a value different from the management cluster's
join subnet (default fd98::/64) to avoid IPv6 routing conflicts.
minProperties: 1
properties:
internalJoinSubnet:
description: |-
internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes.
The current default value is fd98::/64.
For KubeVirt hosted clusters, if this field is not set, HyperShift will
automatically use fd99::/64 to avoid collisions with the management cluster's
default join subnet (fd98::/64).
The subnet must be large enough to accommodate one IP per node in your cluster.
The value must be in proper IPv6 CIDR format.
Note that IPv6 dual addresses are not permitted.
maxLength: 48
minLength: 3
type: string
x-kubernetes-validations:
- message: Subnet must be in valid IPv6 CIDR format
(e.g., fd98::/64)
rule: self.matches('^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:))|(::((:[0-9A-Fa-f]{1,4}){1,7}|:)))\\s*/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$')
- message: subnet must be in the range /0 to /125
inclusive
rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
<= 125
internalTransitSwitchSubnet:
description: |-
internalTransitSwitchSubnet is a v6 subnet in IPv6 CIDR format used internally
by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
architecture that connects the cluster routers on each node together to enable
east west traffic. The subnet chosen should not overlap with other networks
specified for OVN-Kubernetes as well as other networks used on the host.
When omitted, this means no opinion and the platform is left to choose a reasonable
default which is subject to change over time.
The current default subnet is fd97::/64.
The subnet must be large enough to accommodate one IP per node in your cluster.
The value must be in proper IPv6 CIDR format.
Note that IPv6 dual addresses are not permitted.
maxLength: 48
minLength: 3
type: string
x-kubernetes-validations:
- message: Subnet must be in valid IPv6 CIDR format
(e.g., fd97::/64)
rule: self.matches('^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:))|(::((:[0-9A-Fa-f]{1,4}){1,7}|:)))\\s*/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$')
- message: subnet must be in the range /0 to /125
inclusive
rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
<= 125
type: object
type: object
x-kubernetes-validations:
- message: internalJoinSubnet and internalTransitSwitchSubnet
must not be the same
rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
|| !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
!= self.ipv4.internalTransitSwitchSubnet'
- message: IPv6 internalJoinSubnet and internalTransitSwitchSubnet
must not be the same
rule: '!has(self.ipv6) || !has(self.ipv6.internalJoinSubnet)
|| !has(self.ipv6.internalTransitSwitchSubnet) || self.ipv6.internalJoinSubnet
!= self.ipv6.internalTransitSwitchSubnet'
type: object
ingressOperator:
description: |-
Expand Down
64 changes: 64 additions & 0 deletions ....featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2946,13 +2946,77 @@ spec:
rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
> 0
type: object
ipv6:
description: |-
ipv6 allows users to configure IP settings for IPv6 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv6 for details of default values.
For KubeVirt hosted clusters using dual-stack networking, it is recommended to
set ipv6.internalJoinSubnet to a value different from the management cluster's
join subnet (default fd98::/64) to avoid IPv6 routing conflicts.
minProperties: 1
properties:
internalJoinSubnet:
description: |-
internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes.
The current default value is fd98::/64.
For KubeVirt hosted clusters, if this field is not set, HyperShift will
automatically use fd99::/64 to avoid collisions with the management cluster's
default join subnet (fd98::/64).
The subnet must be large enough to accommodate one IP per node in your cluster.
The value must be in proper IPv6 CIDR format.
Note that IPv6 dual addresses are not permitted.
maxLength: 48
minLength: 3
type: string
x-kubernetes-validations:
- message: Subnet must be in valid IPv6 CIDR format
(e.g., fd98::/64)
rule: self.matches('^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:))|(::((:[0-9A-Fa-f]{1,4}){1,7}|:)))\\s*/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$')
- message: subnet must be in the range /0 to /125
inclusive
rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
<= 125
internalTransitSwitchSubnet:
description: |-
internalTransitSwitchSubnet is a v6 subnet in IPv6 CIDR format used internally
by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
architecture that connects the cluster routers on each node together to enable
east west traffic. The subnet chosen should not overlap with other networks
specified for OVN-Kubernetes as well as other networks used on the host.
When omitted, this means no opinion and the platform is left to choose a reasonable
default which is subject to change over time.
The current default subnet is fd97::/64.
The subnet must be large enough to accommodate one IP per node in your cluster.
The value must be in proper IPv6 CIDR format.
Note that IPv6 dual addresses are not permitted.
maxLength: 48
minLength: 3
type: string
x-kubernetes-validations:
- message: Subnet must be in valid IPv6 CIDR format
(e.g., fd97::/64)
rule: self.matches('^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:))|(::((:[0-9A-Fa-f]{1,4}){1,7}|:)))\\s*/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$')
- message: subnet must be in the range /0 to /125
inclusive
rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
<= 125
type: object
type: object
x-kubernetes-validations:
- message: internalJoinSubnet and internalTransitSwitchSubnet
must not be the same
rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
|| !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
!= self.ipv4.internalTransitSwitchSubnet'
- message: IPv6 internalJoinSubnet and internalTransitSwitchSubnet
must not be the same
rule: '!has(self.ipv6) || !has(self.ipv6.internalJoinSubnet)
|| !has(self.ipv6.internalTransitSwitchSubnet) || self.ipv6.internalJoinSubnet
!= self.ipv6.internalTransitSwitchSubnet'
type: object
ingressOperator:
description: |-
Expand Down
Loading