@@ -17,6 +17,7 @@ import (
1717 k8stypes "k8s.io/apimachinery/pkg/types"
1818 "k8s.io/client-go/util/retry"
1919 "k8s.io/klog/v2"
20+ "k8s.io/utils/ptr"
2021
2122 ovncnitypes "github.com/ovn-org/ovn-kubernetes/go-controller/pkg/cni/types"
2223 "github.com/ovn-org/ovn-kubernetes/go-controller/pkg/config"
@@ -98,6 +99,7 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
9899 config .OVNKubernetesFeature .EnableMultiNetwork = true
99100 config .Gateway .Mode = config .GatewayModeShared
100101 config .OVNKubernetesFeature .EgressIPNodeHealthCheckPort = 1234
102+ config .Gateway .V4MasqueradeSubnet = dummyMasqueradeSubnet ().String ()
101103
102104 app = cli .NewApp ()
103105 app .Name = "test"
@@ -1195,9 +1197,11 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
11951197 // Add pod IPs to UDN cache
11961198 iUDN , nUDN , _ := net .ParseCIDR (v4Pod1IPNode1Net1 + "/23" )
11971199 nUDN .IP = iUDN
1200+ secConInfo .bnc .zone = node1 .Name
11981201 secConInfo .bnc .logicalPortCache .add (& egressPodUDNLocal , "" , util .GetNADName (nad .Namespace , nad .Name ), "" , nil , []* net.IPNet {nUDN })
11991202 _ , err = fakeOvn .fakeClient .EgressIPClient .K8sV1 ().EgressIPs ().Create (context .TODO (), & eIP , metav1.CreateOptions {})
12001203 gomega .Expect (err ).NotTo (gomega .HaveOccurred ())
1204+ gomega .Expect (secConInfo .bnc .WatchNodes ()).To (gomega .Succeed ())
12011205 egressSVCServedPodsASv4 , _ := buildEgressServiceAddressSets (nil )
12021206 egressIPServedPodsASCDNv4 , _ := buildEgressIPServedPodsAddressSets ([]string {podV4IP }, ovntypes .DefaultNetworkName , DefaultNetworkControllerName )
12031207 egressNodeIPsASv4 , _ := buildEgressIPNodeAddressSets ([]string {node1IPv4 , node2IPv4 })
@@ -1325,6 +1329,19 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
13251329 Name : ovntypes .GWRouterToJoinSwitchPrefix + ovntypes .GWRouterPrefix + networkName1_ + node1 .Name ,
13261330 Networks : []string {nodeLogicalRouterIfAddrV4 },
13271331 },
1332+ & nbdb.NAT {
1333+ UUID : networkName1_ + node1Name + "-masqueradeNAT-UUID" ,
1334+ ExternalIDs : map [string ]string {
1335+ "k8s.ovn.org/topology" : "layer3" ,
1336+ "k8s.ovn.org/network" : networkName1 ,
1337+ },
1338+ ExternalIP : "169.254.169.14" ,
1339+ LogicalIP : node1UDNSubnet .String (),
1340+ LogicalPort : ptr .To ("rtos-" + networkName1_ + node1Name ),
1341+ Match : "eth.dst == 0a:58:14:80:00:02" ,
1342+ Type : nbdb .NATTypeSNAT ,
1343+ Options : map [string ]string {"stateless" : "false" },
1344+ },
13281345 & nbdb.LogicalRouter {
13291346 Name : netInfo .GetNetworkScopedClusterRouterName (),
13301347 UUID : netInfo .GetNetworkScopedClusterRouterName () + "-UUID" ,
@@ -1333,6 +1350,7 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
13331350 fmt .Sprintf ("%s-no-reroute-reply-traffic" , netInfo .GetNetworkName ()),
13341351 getReRoutePolicyUUID (eipNamespace2 , podName2 , IPFamilyValueV4 , netInfo .GetNetworkName ())},
13351352 StaticRoutes : []string {fmt .Sprintf ("%s-reroute-static-route-UUID" , netInfo .GetNetworkName ())},
1353+ Nat : []string {networkName1_ + node1Name + "-masqueradeNAT-UUID" },
13361354 },
13371355 & nbdb.LogicalRouter {
13381356 UUID : netInfo .GetNetworkScopedGWRouterName (node1 .Name ) + "-UUID" ,
@@ -1345,14 +1363,57 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
13451363 & nbdb.LogicalSwitchPort {
13461364 UUID : "k8s-" + networkName1_ + node1Name + "-UUID" ,
13471365 Name : "k8s-" + networkName1_ + node1Name ,
1348- Addresses : []string {"fe:1a:b2:3f:0e:fb " + util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()},
1366+ Addresses : []string {"0a:58:14:80:00:02 " + util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()},
1367+ },
1368+ & nbdb.LogicalSwitchPort {
1369+ UUID : "stor-" + networkName1_ + node1Name + "-UUID" ,
1370+ Name : "stor-" + networkName1_ + node1Name ,
1371+ Addresses : []string {"router" },
1372+ Options : map [string ]string {"router-port" : "rtos-" + networkName1_ + node1Name },
1373+ Type : "router" ,
1374+ },
1375+ & nbdb.ACL {
1376+ UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-NetpolNode-UUID" ,
1377+ Direction : nbdb .ACLDirectionToLport ,
1378+ Action : nbdb .ACLActionAllowRelated ,
1379+ ExternalIDs : map [string ]string {
1380+ "k8s.ovn.org/name" : networkName1_ + node1Name ,
1381+ "ip" : util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String (),
1382+ "k8s.ovn.org/id" : fmt .Sprintf ("%s-network-controller:NetpolNode:%s:%s" , networkName1 , networkName1_ + node1Name , util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()),
1383+ "k8s.ovn.org/owner-controller" : networkName1 + "-network-controller" ,
1384+ "k8s.ovn.org/owner-type" : "NetpolNode" ,
1385+ },
1386+ Match : fmt .Sprintf ("ip4.src==%s" , util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()),
1387+ Meter : ptr .To (ovntypes .OvnACLLoggingMeter ),
1388+ Priority : ovntypes .PrimaryUDNAllowPriority ,
1389+ Tier : ovntypes .DefaultACLTier ,
13491390 },
13501391 & nbdb.LogicalSwitch {
13511392 UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-UUID" ,
13521393 Name : netInfo .GetNetworkScopedSwitchName (node1 .Name ),
1353- Ports : []string {"k8s-" + networkName1_ + node1Name + "-UUID" },
1394+ Ports : []string {"k8s-" + networkName1_ + node1Name + "-UUID" , "stor-" + networkName1_ + node1Name + "-UUID" },
13541395 ExternalIDs : map [string ]string {ovntypes .NetworkExternalID : netInfo .GetNetworkName (), ovntypes .TopologyExternalID : ovntypes .Layer3Topology },
13551396 QOSRules : []string {fmt .Sprintf ("%s-QoS-UUID" , netInfo .GetNetworkName ())},
1397+ OtherConfig : map [string ]string {
1398+ "exclude_ips" : util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String (),
1399+ "subnet" : node1UDNSubnet .String (),
1400+ },
1401+ ACLs : []string {netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-NetpolNode-UUID" },
1402+ },
1403+ & nbdb.LogicalSwitch {
1404+ UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "TRANSIT-UUID" ,
1405+ Name : networkName1_ + ovntypes .TransitSwitch ,
1406+ ExternalIDs : map [string ]string {
1407+ ovntypes .NetworkExternalID : netInfo .GetNetworkName (),
1408+ ovntypes .TopologyExternalID : ovntypes .Layer3Topology ,
1409+ ovntypes .NetworkRoleExternalID : ovntypes .NetworkRolePrimary },
1410+ OtherConfig : map [string ]string {
1411+ "mcast_snoop" : "true" ,
1412+ "mcast_querier" : "false" ,
1413+ "mcast_flood_unregistered" : "true" ,
1414+ "interconn-ts" : networkName1_ + ovntypes .TransitSwitch ,
1415+ "requested-tnl-key" : "16711685" ,
1416+ },
13561417 },
13571418 getNoReRouteReplyTrafficPolicyForController (netInfo .GetNetworkName (), DefaultNetworkControllerName ),
13581419 getDefaultQoSRule (false , netInfo .GetNetworkName (), DefaultNetworkControllerName ),
@@ -1457,6 +1518,19 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
14571518 Name : ovntypes .GWRouterToJoinSwitchPrefix + ovntypes .GWRouterPrefix + networkName1_ + node1 .Name ,
14581519 Networks : []string {nodeLogicalRouterIfAddrV4 },
14591520 },
1521+ & nbdb.NAT {
1522+ UUID : networkName1_ + node1Name + "-masqueradeNAT-UUID" ,
1523+ ExternalIDs : map [string ]string {
1524+ "k8s.ovn.org/topology" : "layer3" ,
1525+ "k8s.ovn.org/network" : networkName1 ,
1526+ },
1527+ ExternalIP : "169.254.169.14" ,
1528+ LogicalIP : node1UDNSubnet .String (),
1529+ LogicalPort : ptr .To ("rtos-" + networkName1_ + node1Name ),
1530+ Match : "eth.dst == 0a:58:14:80:00:02" ,
1531+ Type : nbdb .NATTypeSNAT ,
1532+ Options : map [string ]string {"stateless" : "false" },
1533+ },
14601534 & nbdb.LogicalRouter {
14611535 Name : netInfo .GetNetworkScopedClusterRouterName (),
14621536 UUID : netInfo .GetNetworkScopedClusterRouterName () + "-UUID" ,
@@ -1465,6 +1539,7 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
14651539 fmt .Sprintf ("%s-no-reroute-reply-traffic" , netInfo .GetNetworkName ()),
14661540 },
14671541 StaticRoutes : []string {fmt .Sprintf ("%s-reroute-static-route-UUID" , netInfo .GetNetworkName ())},
1542+ Nat : []string {networkName1_ + node1Name + "-masqueradeNAT-UUID" },
14681543 },
14691544 & nbdb.LogicalRouter {
14701545 UUID : netInfo .GetNetworkScopedGWRouterName (node1 .Name ) + "-UUID" ,
@@ -1475,14 +1550,57 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
14751550 & nbdb.LogicalSwitchPort {
14761551 UUID : "k8s-" + networkName1_ + node1Name + "-UUID" ,
14771552 Name : "k8s-" + networkName1_ + node1Name ,
1478- Addresses : []string {"fe:1a:b2:3f:0e:fb " + util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()},
1553+ Addresses : []string {"0a:58:14:80:00:02 " + util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()},
1554+ },
1555+ & nbdb.LogicalSwitchPort {
1556+ UUID : "stor-" + networkName1_ + node1Name + "-UUID" ,
1557+ Name : "stor-" + networkName1_ + node1Name ,
1558+ Addresses : []string {"router" },
1559+ Options : map [string ]string {"router-port" : "rtos-" + networkName1_ + node1Name },
1560+ Type : "router" ,
1561+ },
1562+ & nbdb.ACL {
1563+ UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-NetpolNode-UUID" ,
1564+ Direction : nbdb .ACLDirectionToLport ,
1565+ Action : nbdb .ACLActionAllowRelated ,
1566+ ExternalIDs : map [string ]string {
1567+ "k8s.ovn.org/name" : networkName1_ + node1Name ,
1568+ "ip" : util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String (),
1569+ "k8s.ovn.org/id" : fmt .Sprintf ("%s-network-controller:NetpolNode:%s:%s" , networkName1 , networkName1_ + node1Name , util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()),
1570+ "k8s.ovn.org/owner-controller" : networkName1 + "-network-controller" ,
1571+ "k8s.ovn.org/owner-type" : "NetpolNode" ,
1572+ },
1573+ Match : fmt .Sprintf ("ip4.src==%s" , util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()),
1574+ Meter : ptr .To (ovntypes .OvnACLLoggingMeter ),
1575+ Priority : ovntypes .PrimaryUDNAllowPriority ,
1576+ Tier : ovntypes .DefaultACLTier ,
14791577 },
14801578 & nbdb.LogicalSwitch {
14811579 UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-UUID" ,
14821580 Name : netInfo .GetNetworkScopedSwitchName (node1 .Name ),
1483- Ports : []string {"k8s-" + networkName1_ + node1Name + "-UUID" },
1581+ Ports : []string {"k8s-" + networkName1_ + node1Name + "-UUID" , "stor-" + networkName1_ + node1Name + "-UUID" },
14841582 ExternalIDs : map [string ]string {ovntypes .NetworkExternalID : netInfo .GetNetworkName (), ovntypes .TopologyExternalID : ovntypes .Layer3Topology },
14851583 QOSRules : []string {fmt .Sprintf ("%s-QoS-UUID" , netInfo .GetNetworkName ())},
1584+ OtherConfig : map [string ]string {
1585+ "exclude_ips" : util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String (),
1586+ "subnet" : node1UDNSubnet .String (),
1587+ },
1588+ ACLs : []string {netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-NetpolNode-UUID" },
1589+ },
1590+ & nbdb.LogicalSwitch {
1591+ UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "TRANSIT-UUID" ,
1592+ Name : networkName1_ + ovntypes .TransitSwitch ,
1593+ ExternalIDs : map [string ]string {
1594+ ovntypes .NetworkExternalID : netInfo .GetNetworkName (),
1595+ ovntypes .TopologyExternalID : ovntypes .Layer3Topology ,
1596+ ovntypes .NetworkRoleExternalID : ovntypes .NetworkRolePrimary },
1597+ OtherConfig : map [string ]string {
1598+ "mcast_snoop" : "true" ,
1599+ "mcast_querier" : "false" ,
1600+ "mcast_flood_unregistered" : "true" ,
1601+ "interconn-ts" : networkName1_ + ovntypes .TransitSwitch ,
1602+ "requested-tnl-key" : "16711685" ,
1603+ },
14861604 },
14871605 getNoReRouteReplyTrafficPolicyForController (netInfo .GetNetworkName (), DefaultNetworkControllerName ),
14881606 getDefaultQoSRule (false , netInfo .GetNetworkName (), DefaultNetworkControllerName ),
@@ -2415,6 +2533,8 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
24152533 gomega .Expect (err ).NotTo (gomega .HaveOccurred ())
24162534 secConInfo , ok := fakeOvn .secondaryControllers [networkName1 ]
24172535 gomega .Expect (ok ).To (gomega .BeTrue ())
2536+ secConInfo .bnc .zone = node1 .Name
2537+ gomega .Expect (secConInfo .bnc .WatchNodes ()).To (gomega .Succeed ())
24182538 // Add pod IPs to UDN cache
24192539 iUDN , nUDN , _ := net .ParseCIDR (v4Pod1IPNode1Net1 + "/23" )
24202540 nUDN .IP = iUDN
@@ -2553,6 +2673,19 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
25532673 Name : ovntypes .GWRouterToJoinSwitchPrefix + ovntypes .GWRouterPrefix + networkName1_ + node1 .Name ,
25542674 Networks : []string {nodeLogicalRouterIfAddrV4 },
25552675 },
2676+ & nbdb.NAT {
2677+ UUID : networkName1_ + node1Name + "-masqueradeNAT-UUID" ,
2678+ ExternalIDs : map [string ]string {
2679+ "k8s.ovn.org/topology" : "layer3" ,
2680+ "k8s.ovn.org/network" : networkName1 ,
2681+ },
2682+ ExternalIP : "169.254.169.14" ,
2683+ LogicalIP : node1UDNSubnet .String (),
2684+ LogicalPort : ptr .To ("rtos-" + networkName1_ + node1Name ),
2685+ Match : "eth.dst == 0a:58:14:80:00:02" ,
2686+ Type : nbdb .NATTypeSNAT ,
2687+ Options : map [string ]string {"stateless" : "false" },
2688+ },
25562689 & nbdb.LogicalRouter {
25572690 Name : netInfo .GetNetworkScopedClusterRouterName (),
25582691 UUID : netInfo .GetNetworkScopedClusterRouterName () + "-UUID" ,
@@ -2561,6 +2694,7 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
25612694 fmt .Sprintf ("%s-no-reroute-reply-traffic" , netInfo .GetNetworkName ()),
25622695 getReRoutePolicyUUID (eipNamespace2 , podName2 , IPFamilyValueV4 , netInfo .GetNetworkName ())},
25632696 StaticRoutes : []string {fmt .Sprintf ("%s-reroute-static-route-UUID" , netInfo .GetNetworkName ())},
2697+ Nat : []string {networkName1_ + node1Name + "-masqueradeNAT-UUID" },
25642698 },
25652699 & nbdb.LogicalRouter {
25662700 UUID : netInfo .GetNetworkScopedGWRouterName (node1 .Name ) + "-UUID" ,
@@ -2573,14 +2707,58 @@ var _ = ginkgo.Describe("EgressIP Operations for user defined network with topol
25732707 & nbdb.LogicalSwitchPort {
25742708 UUID : "k8s-" + networkName1_ + node1Name + "-UUID" ,
25752709 Name : "k8s-" + networkName1_ + node1Name ,
2576- Addresses : []string {"fe:1a:b2:3f:0e:fb " + util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()},
2710+ Addresses : []string {"0a:58:14:80:00:02 " + util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()},
2711+ },
2712+ & nbdb.LogicalSwitchPort {
2713+ UUID : "stor-" + networkName1_ + node1Name + "-UUID" ,
2714+ Name : "stor-" + networkName1_ + node1Name ,
2715+ Addresses : []string {"router" },
2716+ Options : map [string ]string {"router-port" : "rtos-" + networkName1_ + node1Name },
2717+ Type : "router" ,
2718+ },
2719+ & nbdb.ACL {
2720+ UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-NetpolNode-UUID" ,
2721+ Direction : nbdb .ACLDirectionToLport ,
2722+ Action : nbdb .ACLActionAllowRelated ,
2723+ ExternalIDs : map [string ]string {
2724+ "k8s.ovn.org/name" : networkName1_ + node1Name ,
2725+ "ip" : util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String (),
2726+ "k8s.ovn.org/id" : fmt .Sprintf ("%s-network-controller:NetpolNode:%s:%s" , networkName1 , networkName1_ + node1Name , util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()),
2727+ "k8s.ovn.org/owner-controller" : networkName1 + "-network-controller" ,
2728+ "k8s.ovn.org/owner-type" : "NetpolNode" ,
2729+ },
2730+ Match : fmt .Sprintf ("ip4.src==%s" , util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String ()),
2731+ Meter : ptr .To (ovntypes .OvnACLLoggingMeter ),
2732+ Priority : ovntypes .PrimaryUDNAllowPriority ,
2733+ Tier : ovntypes .DefaultACLTier ,
25772734 },
25782735 & nbdb.LogicalSwitch {
25792736 UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-UUID" ,
25802737 Name : netInfo .GetNetworkScopedSwitchName (node1 .Name ),
2581- Ports : []string {"k8s-" + networkName1_ + node1Name + "-UUID" },
2738+ Ports : []string {"k8s-" + networkName1_ + node1Name + "-UUID" , "stor-" + networkName1_ + node1Name + "-UUID" },
25822739 ExternalIDs : map [string ]string {ovntypes .NetworkExternalID : netInfo .GetNetworkName (), ovntypes .TopologyExternalID : ovntypes .Layer3Topology },
25832740 QOSRules : []string {fmt .Sprintf ("%s-QoS-UUID" , netInfo .GetNetworkName ())},
2741+ OtherConfig : map [string ]string {
2742+ "exclude_ips" : util .GetNodeManagementIfAddr (node1UDNSubnet ).IP .String (),
2743+ "subnet" : node1UDNSubnet .String (),
2744+ },
2745+ ACLs : []string {netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "-NetpolNode-UUID" },
2746+ },
2747+ & nbdb.LogicalSwitch {
2748+ UUID : netInfo .GetNetworkScopedSwitchName (node1 .Name ) + "TRANSIT-UUID" ,
2749+ Name : networkName1_ + ovntypes .TransitSwitch ,
2750+ ExternalIDs : map [string ]string {
2751+ ovntypes .NetworkExternalID : netInfo .GetNetworkName (),
2752+ ovntypes .TopologyExternalID : ovntypes .Layer3Topology ,
2753+ ovntypes .NetworkRoleExternalID : ovntypes .NetworkRolePrimary ,
2754+ },
2755+ OtherConfig : map [string ]string {
2756+ "mcast_snoop" : "true" ,
2757+ "mcast_querier" : "false" ,
2758+ "mcast_flood_unregistered" : "true" ,
2759+ "interconn-ts" : networkName1_ + ovntypes .TransitSwitch ,
2760+ "requested-tnl-key" : "16711685" ,
2761+ },
25842762 },
25852763 getNoReRouteReplyTrafficPolicyForController (netInfo .GetNetworkName (), DefaultNetworkControllerName ),
25862764 getDefaultQoSRule (false , netInfo .GetNetworkName (), DefaultNetworkControllerName ),
0 commit comments