OCPBUGS-33573: ztp: IPsec: configure local gateway mode

[sabinaaledort]

For IPsec support for encrypting traffic to external hosts OVN-Kubernetes network plugin must be configured in local gateway mode

[openshift-ci-robot]

@sabinaaledort: This pull request references Jira Issue OCPBUGS-33573, which is invalid:

• expected the bug to target the "4.16.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

For IPsec support for encrypting traffic to external hosts OVN-Kubernetes network plugin must be configured in local gateway mode

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sabinaaledort]

/jira refresh

[openshift-ci-robot]

@sabinaaledort: This pull request references Jira Issue OCPBUGS-33573, which is invalid:

• expected the bug to target the "4.16.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sabinaaledort]

/jira refresh

[openshift-ci-robot]

@sabinaaledort: This pull request references Jira Issue OCPBUGS-33573, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yliu127

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[yuvalk]

For IPsec support for encrypting traffic to external hosts OVN-Kubernetes network plugin must be configured in local gateway mode

are you sure about that?
from our tests with OCP QE, it works very well in both modes.

[sabinaaledort]

For IPsec support for encrypting traffic to external hosts OVN-Kubernetes network plugin must be configured in local gateway mode

are you sure about that? from our tests with OCP QE, it works very well in both modes.

Are OCP QE have a test to send packets on the IPSec tunnel from a pod? Both me and @bradyallenjohnson
tested it and this is required, also a prerequisite in the docs https://docs.openshift.com/container-platform/4.15/networking/ovn_kubernetes_network_provider/configuring-ipsec-ovn.html#nw-ovn-ipsec-north-south-enable_configuring-ipsec-ovn
Please see the bug https://issues.redhat.com/browse/OCPBUGS-33573

[yuvalk]

@lack / @imiller0
I'm quite surprised this is not set anywhere else
I thought RAN is using LGW only

[lack]

Are there any other consequences to this change that we should document for end users (or us engineers that don't know a lot about the different routing modes)?

[bradyallenjohnson]

Are there any other consequences to this change that we should document for end users (or us engineers that don't know a lot about the different routing modes)?

I thought there might be performance impacts. This should be very easy to confirm. @hnhan ([email protected]) can you confirm this?
If we need to IPSec encrypt egress packets from workloads, then Local GW mode is the only way.

[yuvalk]

Are there any other consequences to this change that we should document for end users (or us engineers that don't know a lot about the different routing modes)?

in SGW network from OVS does not go through the kernel. (what is considered "offloading"):
pod---->br-int--->br-ex---->physical nic
in LGW all traffic goes through the kernel tcpip stack and is subject to it's routing:
pod -->br-int-->ovn-k8s-mp0---kernel route to ipsec tunnel--->physical nic

so LGW is subject to kernel tcpip stack in general and kernel ip routing in particular
allow much much more flexibility and utilizing full networkin featureset of the kernel (bonding, etc). one of the major benefits is probably routing between primary nic and secondary nics which is not available in SGW.
having said all that, which is nice to know, I dont think we need to document that. and LGW/SGW are well documented in the official OCP networking documents (pretty well?)

and though it might come with a cpu overhead price, I think that for RAN, for primary NIC, that is negligible (the primary nic speed is low anyhow.
which is why I believe we should separately discuss moving to LGW across the board for all deployments. it'll be much easier for Telco 5G in general (one less mode to worry about)

in any case, this specific PR is targeting IPsec envs only, that already agreed to have additional CPU, and that is how they are tested (in LGW) so I dont see any risk here.

[lack]

/lgtm

[lack]

/override ci/prow/e2e-aws-ran-profile

[openshift-ci]

@lack: Overrode contexts on behalf of lack: ci/prow/e2e-aws-ran-profile

In response to this:

/override ci/prow/e2e-aws-ran-profile

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yuvalk]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sabinaaledort, yuvalk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ztp/OWNERS [yuvalk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[yuvalk]

/cherry-pick release-4.16

[openshift-cherrypick-robot]

@yuvalk: once the present PR merges, I will cherry-pick it on top of release-4.16 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@sabinaaledort: Jira Issue OCPBUGS-33573: All pull requests linked via external trackers have merged:

• openshift-kni/cnf-features-deploy#1901

Jira Issue OCPBUGS-33573 has been moved to the MODIFIED state.

In response to this:

For IPsec support for encrypting traffic to external hosts OVN-Kubernetes network plugin must be configured in local gateway mode

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@yuvalk: new pull request created: #1933

In response to this:

/cherry-pick release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.