OCPBUGS-57447,OCPBUGS-45056: Refrain from adding Egress IP to public LB backend pool #180
Conversation
openshift-ci-robot
added
jira/severity-critical
|
@arghosh93: This pull request references Jira Issue OCPBUGS-57447, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@arghosh93: This pull request references Jira Issue OCPBUGS-57447, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
arghosh93
changed the title
openshift-ci-robot
added
jira/invalid-bug
|
@arghosh93: This pull request references Jira Issue OCPBUGS-57447, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. This pull request references Jira Issue OCPBUGS-45056, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@arghosh93: This pull request references Jira Issue OCPBUGS-57447, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: This pull request references Jira Issue OCPBUGS-45056, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (jechen@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
arkadeepsen
left a comment
arkadeepsen
left a comment
There was a problem hiding this comment.
Do we have any tests which can be used to verify the changes made in this PR will correctly solve the issue?
pkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller.go
Outdated
Show resolved
Hide resolved
We lack knowledge of API of different cloud providers to fake it. That is the main reason behind not having enough unit tests. |
arghosh93
force-pushed
the
OCPBUGS-57447
branch
from
c2b5065 to
6dca85c
Compare
|
@arghosh93 Does this PR introduce any limitations on pod egress traffic? From my understanding, if we skip adding the EgressIP to the load balancer backend pools, the egress traffic will be restricted to the infra subnet. Is that correct? |
Yes @pperiyasamy , that is correct. The plan is to document this limitation along with a suggestion of using NAT gateway instead of a general purpose public load balancer. I am also gonna notify support team members so that everyone is well aware. |
Thanks @arghosh93 , If this is agreed by everyone, i'm fine with it. one comment on the sync function. |
|
/retest-required |
arghosh93
force-pushed
the
OCPBUGS-57447
branch
from
6dca85c to
57b79e5
Compare
openshift-merge-robot
added
the
needs-rebase
arghosh93
force-pushed
the
OCPBUGS-57447
branch
from
57b79e5 to
02854f1
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (9)
cmd/cloud-network-config-controller/main.gopkg/cloudprovider/azure.gopkg/cloudprovider/cloudprovider.gopkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller.gopkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller_test.gopkg/controller/configmap/configmap_controller.gopkg/controller/controller.gopkg/controller/node/node_controller.gopkg/controller/secret/secret_controller.go
✅ Files skipped from review due to trivial changes (1)
- pkg/cloudprovider/cloudprovider.go
🚧 Files skipped from review as they are similar to previous changes (4)
- pkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller_test.go
- pkg/controller/secret/secret_controller.go
- pkg/controller/node/node_controller.go
- cmd/cloud-network-config-controller/main.go
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
pkg/controller/configmap/configmap_controller.gopkg/controller/controller.gopkg/cloudprovider/azure.gopkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller.go
🧬 Code graph analysis (1)
pkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller.go (3)
pkg/cloudprovider/cloudprovider.go (1)
CloudProviderConfig(88-98)pkg/controller/controller.go (1)
CloudNetworkConfigController(48-68)pkg/cloudprovider/azure.go (2)
PlatformTypeAzure(38-38)Azure(49-60)
🔇 Additional comments (9)
pkg/controller/configmap/configmap_controller.go (1)
106-108: LGTM!The no-op
InitialSync()implementation correctly satisfies the interface requirement. ConfigMapController doesn't need startup cleanup, so returningnilis appropriate.pkg/cloudprovider/azure.go (3)
22-34: LGTM!The new imports are required for the
SyncLBBackendfunction andisCloudPrivateIPConfigAssignedhelper.
225-226: LGTM!The warning log clearly communicates the operational impact of not adding egress IPs to the LB backend pool. This aligns with the PR objective and helps operators understand the connectivity constraints.
683-690: LGTM!The helper correctly identifies assigned CloudPrivateIPConfigs by checking the
Assignedcondition status, which is consistent with the condition handling elsewhere in the codebase.pkg/controller/controller.go (2)
42-45: LGTM!The
InitialSync()interface method is well-documented and correctly positioned in the startup sequence. The comment clearly explains the intended use case.
104-108: LGTM!Calling
InitialSync()after cache sync but before worker startup is the correct placement for one-time cleanup operations that need full cluster state visibility. Failing startup on error is appropriate since incomplete cleanup could leave the cluster in an inconsistent state.pkg/controller/cloudprivateipconfig/cloudprivateipconfig_controller.go (3)
59-61: LGTM!The optional
initialSyncHookfield provides a clean extension point for platform-specific cleanup without coupling the controller to cloud provider implementations.
80-86: LGTM!The Azure-specific hook wiring is appropriately guarded by the platform type check. The type assertion is safe since
PlatformTypeAzureguarantees the client is an*Azureinstance. Capturing the listers in the closure ensures the hook has access to current cluster state duringInitialSync().
131-140: LGTM!The
InitialSync()implementation correctly delegates to the optional hook and provides appropriate logging. The nil check ensures non-Azure platforms safely skip cleanup.
The consensus is to not add egress IP to public load balancer backend pool regardless of the presence of an OutBoundRule. During upgrade this PR let cobtroller removes any egress IP added to public load balancer backend pool previously. Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
arghosh93
force-pushed
the
OCPBUGS-57447
branch
from
b32c33e to
ba4e72b
Compare
|
/retest-required |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: arghosh93, arkadeepsen, kyrtapz, pperiyasamy The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest-required |
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/retest-required |
4 similar comments
|
/retest-required |
|
/retest-required |
|
/retest-required |
|
/retest-required |
|
/retest-requied |
|
/retest-required |
|
/verified by pre-merge testing |
openshift-ci-robot
added
the
verified
|
@yingwang-0320: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
3 similar comments
|
/retest-required |
|
/retest-required |
|
/retest-required |
|
@arghosh93: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/jira refresh The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity. |
openshift-ci-robot
removed
the
jira/valid-bug
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-57447, which is invalid:
Comment This pull request references Jira Issue OCPBUGS-45056, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
8 participants
This PR is to stop adding Egress IP to public load balancer
backend pool regardless of presence of an OutBoundRule in any
Azure cluster.
This change comes with a consequence of no outbound connectivity
except to the infrastructure subnet even if there is no OutBoundRule.
However this is required to tackle following situation:
this PR also let cobtroller remove any egress IP
added to public load balancer backend pool previously.