Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OSASINFRA-3238: Improve API and Ingress VIPs validation #9438

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dkokkino
Copy link
Contributor

@dkokkino dkokkino commented Feb 5, 2025

• This commit enhances VIPs validation to ensure the primary IP family of the VIPs matches the primary IP family of all the network fields.
• Code repurposed from prior closed PR (#7504)

@dkokkino
Copy link
Contributor Author

dkokkino commented Feb 6, 2025

/retest

@dkokkino dkokkino changed the title Improve API and Ingress VIPs validation OSASINFRA-3238: Improve API and Ingress VIPs validation Feb 6, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 6, 2025
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Feb 6, 2025

@dkokkino: This pull request references OSASINFRA-3238 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

In response to this:

• This commit enhances VIPs validation to ensure the primary IP family of the VIPs matches the primary IP family of all the network fields.
• Code repurposed from prior closed PR (#7504)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@dkokkino
Copy link
Contributor Author

dkokkino commented Feb 6, 2025

/retest

Copy link
Contributor

@MaysaMacedo MaysaMacedo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR looks good to me.

I will let others approve as I worked on it in the past.

Copy link
Contributor

openshift-ci bot commented Feb 7, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: MaysaMacedo
Once this PR has been reviewed and has the lgtm label, please assign pawanpinjarkar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@MaysaMacedo
Copy link
Contributor

/cc @mkowalski @mandre

@openshift-ci openshift-ci bot requested review from mandre and mkowalski February 7, 2025 15:21
@MaysaMacedo
Copy link
Contributor

/test e2e-openstack-dualstack

@mkowalski
Copy link
Contributor

/test e2e-metal-ovn-dualstack

Copy link
Contributor

openshift-ci bot commented Feb 7, 2025

@mkowalski: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test altinfra-images
/test aro-unit
/test artifacts-images
/test e2e-agent-compact-ipv4
/test e2e-aws-ovn
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-upi
/test e2e-azure-ovn
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test gofmt
/test golint
/test govet
/test images
/test integration-tests
/test integration-tests-nodejoiner
/test okd-scos-images
/test openstack-manifests
/test terraform-images
/test terraform-verify-vendor
/test unit
/test verify-codegen
/test verify-vendor

The following commands are available to trigger optional jobs:

/test altinfra-e2e-aws-custom-security-groups
/test altinfra-e2e-aws-ovn
/test altinfra-e2e-aws-ovn-fips
/test altinfra-e2e-aws-ovn-imdsv2
/test altinfra-e2e-aws-ovn-localzones
/test altinfra-e2e-aws-ovn-proxy
/test altinfra-e2e-aws-ovn-shared-vpc
/test altinfra-e2e-aws-ovn-shared-vpc-local-zones
/test altinfra-e2e-aws-ovn-shared-vpc-wavelength-zones
/test altinfra-e2e-aws-ovn-single-node
/test altinfra-e2e-aws-ovn-wavelengthzones
/test altinfra-e2e-azure-capi-ovn
/test altinfra-e2e-azure-ovn-shared-vpc
/test altinfra-e2e-gcp-capi-ovn
/test altinfra-e2e-gcp-ovn-byo-network-capi
/test altinfra-e2e-gcp-ovn-secureboot-capi
/test altinfra-e2e-gcp-ovn-xpn-capi
/test altinfra-e2e-ibmcloud-capi-ovn
/test altinfra-e2e-nutanix-capi-ovn
/test altinfra-e2e-openstack-capi-ccpmso
/test altinfra-e2e-openstack-capi-ccpmso-zone
/test altinfra-e2e-openstack-capi-dualstack
/test altinfra-e2e-openstack-capi-dualstack-upi
/test altinfra-e2e-openstack-capi-dualstack-v6primary
/test altinfra-e2e-openstack-capi-externallb
/test altinfra-e2e-openstack-capi-nfv-intel
/test altinfra-e2e-openstack-capi-ovn
/test altinfra-e2e-openstack-capi-proxy
/test altinfra-e2e-vsphere-capi-multi-vcenter-ovn
/test altinfra-e2e-vsphere-capi-ovn
/test altinfra-e2e-vsphere-capi-static-ovn
/test altinfra-e2e-vsphere-capi-zones
/test azure-ovn-marketplace-images
/test e2e-agent-4control-ipv4
/test e2e-agent-5control-ipv4
/test e2e-agent-compact-ipv4-appliance-diskimage
/test e2e-agent-compact-ipv4-none-platform
/test e2e-agent-compact-ipv6-minimaliso
/test e2e-agent-ha-dualstack
/test e2e-agent-sno-ipv4-pxe
/test e2e-agent-sno-ipv6
/test e2e-aws-default-config
/test e2e-aws-overlay-mtu-ovn-1200
/test e2e-aws-ovn-custom-iam-profile
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-proxy
/test e2e-aws-ovn-public-ipv4-pool
/test e2e-aws-ovn-public-ipv4-pool-disabled
/test e2e-aws-ovn-public-subnets
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-user-provisioned-dns
/test e2e-aws-ovn-workers-rhel8
/test e2e-aws-upi-proxy
/test e2e-azure-default-config
/test e2e-azure-ovn-resourcegroup
/test e2e-azure-ovn-shared-vpc
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-upi
/test e2e-azurestack
/test e2e-azurestack-upi
/test e2e-crc
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-gcp-default-config
/test e2e-gcp-ovn-byo-vpc
/test e2e-gcp-ovn-heterogeneous
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-xpn
/test e2e-gcp-secureboot
/test e2e-gcp-upgrade
/test e2e-gcp-upi-xpn
/test e2e-gcp-user-provisioned-dns
/test e2e-ibmcloud-ovn
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-single-node-live-iso
/test e2e-nutanix-ovn
/test e2e-openstack-ccpmso
/test e2e-openstack-ccpmso-zone
/test e2e-openstack-dualstack
/test e2e-openstack-dualstack-upi
/test e2e-openstack-externallb
/test e2e-openstack-nfv-intel
/test e2e-openstack-proxy
/test e2e-openstack-singlestackv6
/test e2e-powervs-capi-ovn
/test e2e-vsphere-externallb-ovn
/test e2e-vsphere-host-groups-ovn-custom-no-upgrade
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn-multi-disk
/test e2e-vsphere-ovn-multi-network
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-upi-zones
/test e2e-vsphere-ovn-zones
/test e2e-vsphere-ovn-zones-techpreview
/test e2e-vsphere-static-ovn
/test okd-scos-e2e-aws-ovn

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-installer-main-altinfra-images
pull-ci-openshift-installer-main-aro-unit
pull-ci-openshift-installer-main-artifacts-images
pull-ci-openshift-installer-main-e2e-aws-ovn
pull-ci-openshift-installer-main-e2e-azure-ovn-resourcegroup
pull-ci-openshift-installer-main-e2e-vsphere-externallb-ovn
pull-ci-openshift-installer-main-e2e-vsphere-ovn-multi-network
pull-ci-openshift-installer-main-e2e-vsphere-static-ovn
pull-ci-openshift-installer-main-gofmt
pull-ci-openshift-installer-main-golint
pull-ci-openshift-installer-main-govet
pull-ci-openshift-installer-main-images
pull-ci-openshift-installer-main-okd-scos-e2e-aws-ovn
pull-ci-openshift-installer-main-okd-scos-images
pull-ci-openshift-installer-main-terraform-images
pull-ci-openshift-installer-main-unit
pull-ci-openshift-installer-main-verify-codegen
pull-ci-openshift-installer-main-verify-vendor

In response to this:

/test e2e-metal-ovn-dualstack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@mkowalski
Copy link
Contributor

/test e2e-metal-ipi-ovn-dualstack

Copy link
Contributor

@mkowalski mkowalski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have a feeling the if-else logic here becomes a real spaghetti...

What we have now is

[1] if len(vips.API) == 0
[2] else if len(vips.API) <= 2
[3]    if len(vips.API) >= 1
[4]    if len(vips.API) == 2

and it seems to me like this could be simplified. For example [3] is redundant if you look and realize that you did not enter [1].

@dkokkino
Copy link
Contributor Author

I have a feeling the if-else logic here becomes a real spaghetti...

What we have now is

[1] if len(vips.API) == 0
[2] else if len(vips.API) <= 2
[3]    if len(vips.API) >= 1
[4]    if len(vips.API) == 2

and it seems to me like this could be simplified. For example [3] is redundant if you look and realize that you did not enter [1].

Thanks for pointing it out! I have removed if statement [3] and made sure the logic within that statement always runs if it enters [2]

Comment on lines 2135 to 2145
name: "baremetal API VIP set to an incorrect IP Family",
installConfig: func() *types.InstallConfig {
c := validInstallConfig()
c.Networking = validDualStackNetworkingConfig()
c.Networking = InvalidPrimaryV6DualStackNetworkingConfig()
c.Platform = types.Platform{
BareMetal: validBareMetalPlatform(),
}
c.Platform.BareMetal.APIVIPs = []string{"ffd0::"}
return c
}(),
expectedError: `platform.baremetal.apiVIPs: Invalid value: "ffd0::": VIP for the API must be of the same IP family with machine network's primary IP Family for dual-stack IPv4/IPv6`,
expectedError: `[platform.baremetal.apiVIPs: Invalid value: "ffd0::": serviceNetwork primary IP Family and primary IP family for the API VIP should match]`,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add your own test case instead of modifying the current one. They are not testing exactly the same combination, even though in today's logic of validateAPIAndIngressVIPs they run through the same code (tomorrow someone may modify the validation and one thing suddenly regresses and starts to pass)

Basically, your test is

  • machine network primary v6
  • service network primary v4
  • cluster network primary v6
  • api vip v6

and the old test is

  • machine network primary v4
  • service network primary v4
  • cluster network primary v4
  • api vip v6

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mkowalski I added my own new tests instead of modifying the current ones as you suggested please let me know if you have any further advice.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is great that you added a new one! You only need now to fix the error message for existing test(s) because of your modification, i.e. look at the failure

Error:      	Expect "[platform.baremetal.ingressVIPs: Invalid value: "ffd0::": machineNetwork primary IP Family and primary IP family for the Ingress VIP should match, platform.baremetal.ingressVIPs: Invalid value: "ffd0::": serviceNetwork primary IP Family and primary IP family for the Ingress VIP should match, platform.baremetal.ingressVIPs: Invalid value: "ffd0::": clusterNetwork primary IP Family and primary IP family for the Ingress VIP should match]" to match "platform.baremetal.ingressVIPs: Invalid value: "ffd0::": VIP for the Ingress must be of the same IP family with machine network's primary IP Family for dual-stack IPv4/IPv6"

In the past there was only one error message for the mismatch. Now you append an error for every of machine, service, and cluster networks. Old test(s) do not know about this change.

You need to go one-by-one over whatever unit test(s) failed and fix expected error messages.

@mkowalski
Copy link
Contributor

Thanks a lot! The logic looks much more elegant now

/test e2e-metal-ovn-dualstack

Copy link
Contributor

openshift-ci bot commented Feb 12, 2025

@mkowalski: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test altinfra-images
/test aro-unit
/test artifacts-images
/test e2e-agent-compact-ipv4
/test e2e-aws-ovn
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-upi
/test e2e-azure-ovn
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test gofmt
/test golint
/test govet
/test images
/test integration-tests
/test integration-tests-nodejoiner
/test okd-scos-images
/test openstack-manifests
/test terraform-images
/test terraform-verify-vendor
/test unit
/test verify-codegen
/test verify-vendor

The following commands are available to trigger optional jobs:

/test altinfra-e2e-aws-custom-security-groups
/test altinfra-e2e-aws-ovn
/test altinfra-e2e-aws-ovn-fips
/test altinfra-e2e-aws-ovn-imdsv2
/test altinfra-e2e-aws-ovn-localzones
/test altinfra-e2e-aws-ovn-proxy
/test altinfra-e2e-aws-ovn-shared-vpc
/test altinfra-e2e-aws-ovn-shared-vpc-local-zones
/test altinfra-e2e-aws-ovn-shared-vpc-wavelength-zones
/test altinfra-e2e-aws-ovn-single-node
/test altinfra-e2e-aws-ovn-wavelengthzones
/test altinfra-e2e-azure-capi-ovn
/test altinfra-e2e-azure-ovn-shared-vpc
/test altinfra-e2e-gcp-capi-ovn
/test altinfra-e2e-gcp-ovn-byo-network-capi
/test altinfra-e2e-gcp-ovn-secureboot-capi
/test altinfra-e2e-gcp-ovn-xpn-capi
/test altinfra-e2e-ibmcloud-capi-ovn
/test altinfra-e2e-nutanix-capi-ovn
/test altinfra-e2e-openstack-capi-ccpmso
/test altinfra-e2e-openstack-capi-ccpmso-zone
/test altinfra-e2e-openstack-capi-dualstack
/test altinfra-e2e-openstack-capi-dualstack-upi
/test altinfra-e2e-openstack-capi-dualstack-v6primary
/test altinfra-e2e-openstack-capi-externallb
/test altinfra-e2e-openstack-capi-nfv-intel
/test altinfra-e2e-openstack-capi-ovn
/test altinfra-e2e-openstack-capi-proxy
/test altinfra-e2e-vsphere-capi-multi-vcenter-ovn
/test altinfra-e2e-vsphere-capi-ovn
/test altinfra-e2e-vsphere-capi-static-ovn
/test altinfra-e2e-vsphere-capi-zones
/test azure-ovn-marketplace-images
/test e2e-agent-4control-ipv4
/test e2e-agent-5control-ipv4
/test e2e-agent-compact-ipv4-appliance-diskimage
/test e2e-agent-compact-ipv4-none-platform
/test e2e-agent-compact-ipv6-minimaliso
/test e2e-agent-ha-dualstack
/test e2e-agent-sno-ipv4-pxe
/test e2e-agent-sno-ipv6
/test e2e-aws-default-config
/test e2e-aws-overlay-mtu-ovn-1200
/test e2e-aws-ovn-custom-iam-profile
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-proxy
/test e2e-aws-ovn-public-ipv4-pool
/test e2e-aws-ovn-public-ipv4-pool-disabled
/test e2e-aws-ovn-public-subnets
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-user-provisioned-dns
/test e2e-aws-ovn-workers-rhel8
/test e2e-aws-upi-proxy
/test e2e-azure-default-config
/test e2e-azure-ovn-resourcegroup
/test e2e-azure-ovn-shared-vpc
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-upi
/test e2e-azurestack
/test e2e-azurestack-upi
/test e2e-crc
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-gcp-default-config
/test e2e-gcp-ovn-byo-vpc
/test e2e-gcp-ovn-heterogeneous
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-xpn
/test e2e-gcp-secureboot
/test e2e-gcp-upgrade
/test e2e-gcp-upi-xpn
/test e2e-gcp-user-provisioned-dns
/test e2e-ibmcloud-ovn
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-single-node-live-iso
/test e2e-nutanix-ovn
/test e2e-openstack-ccpmso
/test e2e-openstack-ccpmso-zone
/test e2e-openstack-dualstack
/test e2e-openstack-dualstack-upi
/test e2e-openstack-externallb
/test e2e-openstack-nfv-intel
/test e2e-openstack-proxy
/test e2e-openstack-singlestackv6
/test e2e-powervs-capi-ovn
/test e2e-vsphere-externallb-ovn
/test e2e-vsphere-host-groups-ovn-custom-no-upgrade
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn-multi-disk
/test e2e-vsphere-ovn-multi-network
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-upi-zones
/test e2e-vsphere-ovn-zones
/test e2e-vsphere-ovn-zones-techpreview
/test e2e-vsphere-static-ovn
/test okd-scos-e2e-aws-ovn

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-installer-main-altinfra-images
pull-ci-openshift-installer-main-aro-unit
pull-ci-openshift-installer-main-artifacts-images
pull-ci-openshift-installer-main-e2e-aws-ovn
pull-ci-openshift-installer-main-e2e-azure-ovn-resourcegroup
pull-ci-openshift-installer-main-e2e-vsphere-externallb-ovn
pull-ci-openshift-installer-main-e2e-vsphere-ovn-multi-network
pull-ci-openshift-installer-main-e2e-vsphere-static-ovn
pull-ci-openshift-installer-main-gofmt
pull-ci-openshift-installer-main-golint
pull-ci-openshift-installer-main-govet
pull-ci-openshift-installer-main-images
pull-ci-openshift-installer-main-okd-scos-e2e-aws-ovn
pull-ci-openshift-installer-main-okd-scos-images
pull-ci-openshift-installer-main-terraform-images
pull-ci-openshift-installer-main-unit
pull-ci-openshift-installer-main-verify-codegen
pull-ci-openshift-installer-main-verify-vendor

In response to this:

Thanks a lot! The logic looks much more elegant now

/test e2e-metal-ovn-dualstack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@mkowalski
Copy link
Contributor

/test e2e-metal-ipi-ovn-dualstack

@mkowalski
Copy link
Contributor

/test e2e-openstack-dualstack

• This commit enhances VIPs validation to ensure the primary IP
family of the VIPs matches the primary IP family of all the network fields.
• Code repurposed from prior closed PR (openshift#7504)

Co-Authored-By: Maysa Macedo <[email protected]>
Co-Authored-By: Danny Kokkinos <[email protected]>
@mkowalski
Copy link
Contributor

/test e2e-openstack-dualstack
/test e2e-metal-ipi-ovn-dualstack

Copy link
Contributor

openshift-ci bot commented Feb 19, 2025

@dkokkino: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-vsphere-host-groups-ovn-custom-no-upgrade eb8ab29 link false /test e2e-vsphere-host-groups-ovn-custom-no-upgrade
ci/prow/okd-scos-images 138870e link true /test okd-scos-images
ci/prow/e2e-vsphere-ovn-multi-network 138870e link false /test e2e-vsphere-ovn-multi-network
ci/prow/aro-unit 138870e link true /test aro-unit
ci/prow/e2e-vsphere-static-ovn 138870e link false /test e2e-vsphere-static-ovn
ci/prow/unit 138870e link true /test unit
ci/prow/e2e-vsphere-externallb-ovn 138870e link false /test e2e-vsphere-externallb-ovn
ci/prow/okd-scos-e2e-aws-ovn 138870e link false /test okd-scos-e2e-aws-ovn
ci/prow/e2e-openstack-dualstack 138870e link false /test e2e-openstack-dualstack

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants