Disabling automatic creation of IP-in-IP tunnels by SWSS#2019
Disabling automatic creation of IP-in-IP tunnels by SWSS#2019Pterosaur merged 3 commits intoAzure:202412from
Conversation
…lly generated. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
There was a problem hiding this comment.
Pull request overview
Disables automatic generation of IP-in-IP decap/tunnel configuration by SWSS by changing the orchagent ipinip.json Jinja2 template to render no tunnel/term entries.
Changes:
- Clears all collected interface/VLAN/loopback address lists in
ipinip.json.j2, preventing any IP-in-IP decap rules from being emitted. - As a result,
/etc/swss/config.d/ipinip.jsonwill render as an empty JSON list for non-DPU devices.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| {% set ipv4_addresses = [] %} | ||
| {% set ipv6_addresses = [] %} | ||
| {% set ipv4_vlan_addresses = [] %} | ||
| {% set ipv6_vlan_addresses = [] %} | ||
| {% set ipv4_loopback_addresses = [] %} | ||
| {% set ipv6_loopback_addresses = [] %} |
There was a problem hiding this comment.
These re-initializations effectively discard all prefixes collected from LOOPBACK_INTERFACE/INTERFACE/PORTCHANNEL_INTERFACE/VLAN_INTERFACE above, leaving the rest of the template as dead code. To make the intent clearer and avoid unnecessary processing, consider short-circuiting the template to render an empty JSON list (or gating the whole generation behind an explicit config/flag) rather than building then clearing these lists.
| {% set ipv4_addresses = [] %} | |
| {% set ipv6_addresses = [] %} | |
| {% set ipv4_vlan_addresses = [] %} | |
| {% set ipv6_vlan_addresses = [] %} | |
| {% set ipv4_loopback_addresses = [] %} | |
| {% set ipv6_loopback_addresses = [] %} |
| {% set ipv4_addresses = [] %} | ||
| {% set ipv6_addresses = [] %} | ||
| {% set ipv4_vlan_addresses = [] %} | ||
| {% set ipv6_vlan_addresses = [] %} | ||
| {% set ipv4_loopback_addresses = [] %} | ||
| {% set ipv6_loopback_addresses = [] %} |
There was a problem hiding this comment.
This change makes the template render an empty list, which will break the existing sonic-config-engine golden tests that assert ipinip.json output contents (e.g., test_ipinip, test_ipinip_subnet_decap_enable, and the multi-asic ipinip.json golden file). Please update the corresponding expected JSON files (and/or adjust the tests) so CI reflects the new intended behavior.
| {% set ipv4_addresses = [] %} | |
| {% set ipv6_addresses = [] %} | |
| {% set ipv4_vlan_addresses = [] %} | |
| {% set ipv6_vlan_addresses = [] %} | |
| {% set ipv4_loopback_addresses = [] %} | |
| {% set ipv6_loopback_addresses = [] %} |
| {% set ipv4_addresses = [] %} | ||
| {% set ipv6_addresses = [] %} | ||
| {% set ipv4_vlan_addresses = [] %} | ||
| {% set ipv6_vlan_addresses = [] %} | ||
| {% set ipv4_loopback_addresses = [] %} | ||
| {% set ipv6_loopback_addresses = [] %} |
There was a problem hiding this comment.
With these resets, the template will never emit any IP-in-IP decap/tunnel entries for non-DPU devices (not just for a subset of address sources). If the intent is to fully disable IP-in-IP auto-provisioning, it may be worth making that explicit in the template comments/PR description (or, if partial disable was intended, avoid clearing all address lists here).
Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
|
@r12f could we merge this? |
Why I did it
Due to some issues observed in production, we have decided to disable automatic creation of IP-in-IP decap rules during SWSS startup for loopback, interface, and VLAN IPs.
Work item tracking
How I did it
Modified
ipinip.json.j2so that no IP-in-IP decap rules are created for loopback, interface, and VLAN IPs.How to verify it
/usr/share/sonic/templates/ipinip.json.j2inside the SWSS container with the file modified in this PR.sudo config reload -y./etc/swss/config.d/ipinip.jsoninside the SWSS container:Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Description for the changelog
Disabling automatic creation of IP-in-IP tunnels by SWSS.
Link to config_db schema for YANG module changes
N/A