OCPBUGS-61167: pkg/types/valication: explain overlapping internal subnets better #10039

jhixson74 · 2025-10-28T23:42:35Z

Let users know what to do when they get an overlapping subnet error.

https://issues.redhat.com/browse/OCPBUGS-61167

openshift-ci-robot · 2025-10-28T23:42:42Z

@jhixson74: This pull request references Jira Issue OCPBUGS-61167, which is invalid:

expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Let users know what to do when they get an overlapping subnet error.

https://issues.redhat.com/browse/OCPBUGS-61167

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rna-afk · 2025-10-29T13:44:56Z

/lgtm

tthvo · 2025-11-04T20:59:42Z

/jira refresh

openshift-ci-robot · 2025-11-04T20:59:50Z

@tthvo: This pull request references Jira Issue OCPBUGS-61167, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @gpei

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tthvo

Looks good to me! I just have a small suggestion above.

The unit test is quite strict in term of expected output, so we would need to fix to expect the new error message: ci/prow/unit.

tthvo · 2025-11-04T21:58:35Z

pkg/types/validation/installconfig.go

 		// Join subnet
 		if ovnsubnet, configured := getOVNSubnet(joinSubnet); !configured && validate.DoCIDRsOverlap(network, ovnsubnet) {
-			allErrs = append(allErrs, field.Invalid(fldPath, network.String(), fmt.Sprintf("must not overlap with OVNKubernetes default internal subnet %s", ovnsubnet.String())))
+			allErrs = append(allErrs, field.Invalid(fldPath, network.String(), fmt.Sprintf("must not overlap with OVNKubernetes default internal subnet %s: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation", ovnsubnet.String())))


I think this code checks for both ipv4 and ipv6:

installer/pkg/types/validation/installconfig.go

Lines 606 to 610 in 0278beb

if network.IP.To4() != nil {

subnetsCheck(validate.OVNIPv4JoinSubnet, validate.OVNIPv4TransitSubnet, validate.OVNIPv4MasqueradeSubnet)

} else {

subnetsCheck(validate.OVNIPv6JoinSubnet, validate.OVNIPv6TransitSubnet, validate.OVNIPv6MasqueradeSubnet)

}

As of now, we only have overrides for ipv4. For future proof, maybe we can use the message:

Suggested change

allErrs = append(allErrs, field.Invalid(fldPath, network.String(), fmt.Sprintf("must not overlap with OVNKubernetes default internal subnet %s: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation", ovnsubnet.String())))

allErrs = append(allErrs, field.Invalid(fldPath, network.String(), fmt.Sprintf("must not overlap with OVNKubernetes default internal subnet %s. To override the OVNKubernetes defaults, configure the field 'networking.ovnKubernetesConfig'", ovnsubnet.String())))

patrickdillon · 2025-11-10T16:22:58Z

/approve

Unit tests need to be fixed.

openshift-ci · 2025-11-10T16:27:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: patrickdillon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [patrickdillon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gpei · 2025-11-11T10:29:49Z

With this PR, when machine network overlaps with the default OVN-Kubernetes internal subnet, the error message directs users to the proper documentation

# ./openshift-install create manifests --dir 1111/
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: networking.machineNetwork[0]: Invalid value: "100.64.50.0/24": must not overlap with OVNKubernetes default internal subnet 100.64.0.0/16: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation

And the corresponding installer documentation explains the usage of internalJoinSubnet

# ./openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4
KIND:     InstallConfig
VERSION:  v1

RESOURCE: <object>
  ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv4 for details of default values.

FIELDS:
    internalJoinSubnet <string>
      internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes. The value cannot be changed
after installation.
The current default value is 100.64.0.0/16
The subnet must be large enough to accommodate one IP per node in your cluster
The value must be in proper IPV4 CIDR format

/verified by @gpei

openshift-ci-robot · 2025-11-11T10:30:02Z

@gpei: This PR has been marked as verified by @gpei.

In response to this:

With this PR, when machine network overlaps with the default OVN-Kubernetes internal subnet, the error message directs users to the proper documentation

# ./openshift-install create manifests --dir 1111/
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: networking.machineNetwork[0]: Invalid value: "100.64.50.0/24": must not overlap with OVNKubernetes default internal subnet 100.64.0.0/16: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation

And the corresponding installer documentation explains the usage of internalJoinSubnet

# ./openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4
KIND:     InstallConfig
VERSION:  v1

RESOURCE: <object>
 ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv4 for details of default values.

FIELDS:
   internalJoinSubnet <string>
     internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes. The value cannot be changed
after installation.
The current default value is 100.64.0.0/16
The subnet must be large enough to accommodate one IP per node in your cluster
The value must be in proper IPV4 CIDR format

/verified by @gpei

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-11-11T10:41:35Z

/retest-required

Remaining retests: 0 against base HEAD c999161 and 2 for PR HEAD 0b89eb0 in total

openshift-ci-robot · 2025-11-11T21:00:39Z

/retest-required

Remaining retests: 0 against base HEAD 8ecd944 and 1 for PR HEAD 0b89eb0 in total

Let users know what to do when they get an overlapping subnet error. https://issues.redhat.com/browse/OCPBUGS-61167

tthvo

/lgtm

Looks good to me 👍

Just a heads up: there's currently no support for overriding IPv6 default subnets (the networking.ovnKubernetesConfig.ipv6 field isn't implemented yet). Not sure if users will find this surprising, but it is OK for me.

openshift-ci · 2025-11-12T06:30:25Z

@jhixson74: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

gpei · 2025-11-12T07:40:36Z

Test again with the latest change.

Installer will fail with error message that includes helpful guidance when machineNetwork/clusterNetwork overlaps with OVN-Kubernetes default internal subnet

networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 100.64.40.0/24
  networkType: OVNKubernetes
  serviceNetwork:
  - 172.30.0.0/16

# ./openshift-install create manifests --dir 1112
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: networking.machineNetwork[0]: Invalid value: "100.64.40.0/24": must not overlap with OVNKubernetes default internal subnet 100.64.0.0/16: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation

networking:
  clusterNetwork:
  - cidr: 100.64.0.0/16
    hostPrefix: 23
  machineNetwork:
  - cidr: 192.168.1.0/24
  networkType: OVNKubernetes
  serviceNetwork:
  - 172.30.0.0/16

./openshift-install create manifests --dir 1112
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: networking.clusterNetwork[0].cidr: Invalid value: "100.64.0.0/16": must not overlap with OVNKubernetes default internal subnet 100.64.0.0/16: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation

The suggested openshift-install explain command provides useful information

# ./openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4
KIND:     InstallConfig
VERSION:  v1

RESOURCE: <object>
  ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv4 for details of default values.

FIELDS:
    internalJoinSubnet <string>
      internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes. The value cannot be changed
after installation.
The current default value is 100.64.0.0/16
The subnet must be large enough to accommodate one IP per node in your cluster
The value must be in proper IPV4 CIDR format

Users can successfully resolve the overlap by configuring custom OVN subnets as documented

   networking:
     clusterNetwork:
     - cidr: 162.21.0.0/16
       hostPrefix: 23
     machineNetwork:
     - cidr: 100.64.40.0/24
     networkType: OVNKubernetes
     serviceNetwork:
     - 168.30.0.0/16
     ovnKubernetesConfig:
       ipv4:
         internalJoinSubnet: 100.88.0.0/16         

# ./openshift-install create manifests --dir 1112
...

# cat 1112/manifests/cluster-network-03-config.yml
apiVersion: operator.openshift.io/v1
kind: Network
metadata:
  creationTimestamp: null
  name: cluster
spec:
  clusterNetwork:
  - cidr: 162.21.0.0/16
    hostPrefix: 23
  defaultNetwork:
    ovnKubernetesConfig:
      egressIPConfig: {}
      ipv4:
        internalJoinSubnet: 100.88.0.0/16
    type: OVNKubernetes
  disableNetworkDiagnostics: false
  managementState: Managed
  observedConfig: null
  serviceNetwork:
  - 172.30.0.0/16
  unsupportedConfigOverrides: null
status:
  readyReplicas: 0

/verified by @gpei

openshift-ci-robot · 2025-11-12T07:40:48Z

@gpei: This PR has been marked as verified by @gpei.

In response to this:

Test again with the latest change.

Installer will fail with error message that includes helpful guidance when machineNetwork/clusterNetwork overlaps with OVN-Kubernetes default internal subnet

networking:
 clusterNetwork:
 - cidr: 10.128.0.0/14
   hostPrefix: 23
 machineNetwork:
 - cidr: 100.64.40.0/24
 networkType: OVNKubernetes
 serviceNetwork:
 - 172.30.0.0/16

# ./openshift-install create manifests --dir 1112
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: networking.machineNetwork[0]: Invalid value: "100.64.40.0/24": must not overlap with OVNKubernetes default internal subnet 100.64.0.0/16: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation

networking:
 clusterNetwork:
 - cidr: 100.64.0.0/16
   hostPrefix: 23
 machineNetwork:
 - cidr: 192.168.1.0/24
 networkType: OVNKubernetes
 serviceNetwork:
 - 172.30.0.0/16

./openshift-install create manifests --dir 1112
ERROR failed to fetch Master Machines: failed to load asset "Install Config": failed to create install config: invalid "install-config.yaml" file: networking.clusterNetwork[0].cidr: Invalid value: "100.64.0.0/16": must not overlap with OVNKubernetes default internal subnet 100.64.0.0/16: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation

The suggested openshift-install explain command provides useful information

# ./openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4
KIND:     InstallConfig
VERSION:  v1

RESOURCE: <object>
 ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv4 for details of default values.

FIELDS:
   internalJoinSubnet <string>
     internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes. The value cannot be changed
after installation.
The current default value is 100.64.0.0/16
The subnet must be large enough to accommodate one IP per node in your cluster
The value must be in proper IPV4 CIDR format

Users can successfully resolve the overlap by configuring custom OVN subnets as documented

  networking:
    clusterNetwork:
    - cidr: 162.21.0.0/16
      hostPrefix: 23
    machineNetwork:
    - cidr: 100.64.40.0/24
    networkType: OVNKubernetes
    serviceNetwork:
    - 168.30.0.0/16
    ovnKubernetesConfig:
      ipv4:
        internalJoinSubnet: 100.88.0.0/16         

# ./openshift-install create manifests --dir 1112
...

# cat 1112/manifests/cluster-network-03-config.yml
apiVersion: operator.openshift.io/v1
kind: Network
metadata:
 creationTimestamp: null
 name: cluster
spec:
 clusterNetwork:
 - cidr: 162.21.0.0/16
   hostPrefix: 23
 defaultNetwork:
   ovnKubernetesConfig:
     egressIPConfig: {}
     ipv4:
       internalJoinSubnet: 100.88.0.0/16
   type: OVNKubernetes
 disableNetworkDiagnostics: false
 managementState: Managed
 observedConfig: null
 serviceNetwork:
 - 172.30.0.0/16
 unsupportedConfigOverrides: null
status:
 readyReplicas: 0

/verified by @gpei

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-11-12T07:44:24Z

@jhixson74: Jira Issue Verification Checks: Jira Issue OCPBUGS-61167
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-61167 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

In response to this:

Let users know what to do when they get an overlapping subnet error.

https://issues.redhat.com/browse/OCPBUGS-61167

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2025-11-13T14:41:51Z

Fix included in accepted release 4.21.0-0.nightly-2025-11-13-042845

openshift-ci bot requested review from bfournie and rna-afk October 28, 2025 23:43

openshift-ci bot assigned rna-afk Oct 29, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 29, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Nov 4, 2025

openshift-ci bot requested a review from gpei November 4, 2025 20:59

tthvo reviewed Nov 4, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 10, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 11, 2025

pkg/types/valication: explain overlapping internal subnets better

f09aa9e

Let users know what to do when they get an overlapping subnet error. https://issues.redhat.com/browse/OCPBUGS-61167

jhixson74 force-pushed the main-OCPBUGS-61167 branch from 0b89eb0 to f09aa9e Compare November 12, 2025 02:34

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Nov 12, 2025

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Nov 12, 2025

tthvo reviewed Nov 12, 2025

View reviewed changes

openshift-ci bot assigned tthvo Nov 12, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 12, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 12, 2025

openshift-merge-bot bot merged commit 8a14a07 into openshift:main Nov 12, 2025
15 checks passed

	if network.IP.To4() != nil {
	subnetsCheck(validate.OVNIPv4JoinSubnet, validate.OVNIPv4TransitSubnet, validate.OVNIPv4MasqueradeSubnet)
	} else {
	subnetsCheck(validate.OVNIPv6JoinSubnet, validate.OVNIPv6TransitSubnet, validate.OVNIPv6MasqueradeSubnet)
	}

	allErrs = append(allErrs, field.Invalid(fldPath, network.String(), fmt.Sprintf("must not overlap with OVNKubernetes default internal subnet %s: please run 'openshift-install explain installconfig.networking.ovnKubernetesConfig.ipv4' for further documentation", ovnsubnet.String())))
	allErrs = append(allErrs, field.Invalid(fldPath, network.String(), fmt.Sprintf("must not overlap with OVNKubernetes default internal subnet %s. To override the OVNKubernetes defaults, configure the field 'networking.ovnKubernetesConfig'", ovnsubnet.String())))

OCPBUGS-61167: pkg/types/valication: explain overlapping internal subnets better #10039

OCPBUGS-61167: pkg/types/valication: explain overlapping internal subnets better #10039

Uh oh!

Conversation

jhixson74 commented Oct 28, 2025

Uh oh!

openshift-ci-robot commented Oct 28, 2025

Uh oh!

rna-afk commented Oct 29, 2025

Uh oh!

tthvo commented Nov 4, 2025

Uh oh!

openshift-ci-robot commented Nov 4, 2025

Uh oh!

tthvo left a comment

Choose a reason for hiding this comment

Uh oh!

tthvo Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

patrickdillon commented Nov 10, 2025

Uh oh!

openshift-ci bot commented Nov 10, 2025

Uh oh!

gpei commented Nov 11, 2025

Uh oh!

openshift-ci-robot commented Nov 11, 2025

Uh oh!

openshift-ci-robot commented Nov 11, 2025

Uh oh!

openshift-ci-robot commented Nov 11, 2025

Uh oh!

tthvo left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 12, 2025

Uh oh!

gpei commented Nov 12, 2025

Uh oh!

openshift-ci-robot commented Nov 12, 2025

Uh oh!

Uh oh!

openshift-ci-robot commented Nov 12, 2025

Uh oh!

openshift-merge-robot commented Nov 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants