OCPBUGS-62144: Restart pods when rendering egressIP settings

Signed-off-by: Raphael Rosa <raprosa@redhat.com>

Author: raphaelvrosa

README.md

@@ -146,7 +146,7 @@ Other values are ignored. If you wish to use use a third-party network provider
 
 
 ### Configuring OVNKubernetes
-OVNKubernetes supports the following configuration options, all of which are optional and once set at cluster creation, they can't be changed except for `gatewayConfig` and `IPsec` which can be changed at runtime:
+OVNKubernetes supports the following configuration options, all of which are optional and once set at cluster creation, they can't be changed except for `gatewayConfig`, `IPsec` and `reachabilityTotalTimeoutSeconds` which can be changed at runtime:
 * `MTU`: The MTU to use for the geneve overlay. The default is the MTU of the node that the cluster-network-operator is first run on, minus 100 bytes for geneve overhead. If the nodes in your cluster don't all have the same MTU then you may need to set this explicitly.
 * `genevePort`: The UDP port to use for the Geneve overlay. The default is 6081.
 * `hybridOverlayConfig`: hybrid linux/windows cluster (see below).

bindata/network/ovn-kubernetes/common/008-script-lib.yaml

@@ -571,6 +571,13 @@ data:
 
       # enable egress ip, egress firewall, egress qos, egress service
       egress_features_enable_flag="--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true"
+
+      {{- if .ReachabilityTotalTimeoutSeconds }}
+      if [[ "{{.ReachabilityTotalTimeoutSeconds}}" != "" ]]; then
+        egress_features_enable_flag="$egress_features_enable_flag --egressip-reachability-total-timeout {{.ReachabilityTotalTimeoutSeconds}}"
+      fi
+      {{ end }}
+
       init_ovnkube_controller="--init-ovnkube-controller ${K8S_NODE}"
       multi_external_gateway_enable_flag="--enable-multi-external-gateway=true"
       gateway_interface=br-ex

bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml

@@ -156,6 +156,13 @@ spec:
             fi
           done
 
+          {{- if .ReachabilityTotalTimeoutSeconds }}                 
+          ovn_eip_reachability_timeout_opt=
+          if [[ "{{.ReachabilityTotalTimeoutSeconds}}" != "" ]]; then
+            ovn_eip_reachability_timeout_opt="--egressip-reachability-total-timeout {{.ReachabilityTotalTimeoutSeconds}}"
+          fi
+          {{ end }}
+
           ovn_v4_join_subnet_opt=
           if [[ "{{.V4JoinSubnet}}" != "" ]]; then
             ovn_v4_join_subnet_opt="--gateway-v4-join-subnet {{.V4JoinSubnet}}"
@@ -249,6 +256,7 @@ spec:
             ${evpn_enable_flag} \
             ${preconfigured_udn_addresses_enable_flag} \
             --enable-egress-ip=true \
+            ${ovn_eip_reachability_timeout_opt} \
             --enable-egress-firewall=true \
             --enable-egress-qos=true \
             --enable-egress-service=true \

bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml

@@ -102,6 +102,13 @@ spec:
             source "/env/_master"
             set +o allexport
           fi
+          
+          {{- if .ReachabilityTotalTimeoutSeconds }}        
+          ovn_eip_reachability_timeout_opt=
+          if [[ "{{.ReachabilityTotalTimeoutSeconds}}" != "" ]]; then
+            ovn_eip_reachability_timeout_opt="--egressip-reachability-total-timeout {{.ReachabilityTotalTimeoutSeconds}}"
+          fi
+          {{ end }}
 
           ovn_v4_join_subnet_opt=
           if [[ "{{.V4JoinSubnet}}" != "" ]]; then
@@ -203,6 +210,7 @@ spec:
             ${evpn_enable_flag} \
             ${preconfigured_udn_addresses_enable_flag} \
             --enable-egress-ip=true \
+            ${ovn_eip_reachability_timeout_opt} \
             --enable-egress-firewall=true \
             --enable-egress-qos=true \
             --enable-egress-service=true \

pkg/network/ovn_kubernetes_test.go

@@ -3944,6 +3944,179 @@ func TestRenderOVNKubernetesEnablePersistentIPs(t *testing.T) {
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("CustomResourceDefinition", "", "ipamclaims.k8s.cni.cncf.io")))
 }
 
+// TestRenderOVNKubernetesReachability tests egress IP reachability timeout rendering
+func TestRenderOVNKubernetesReachability(t *testing.T) {
+	g := NewGomegaWithT(t)
+
+	testCases := []struct {
+		name                                string
+		reachabilityTimeout                 *uint32
+		expectKubernetesFeatureReachability bool
+		expectErr                           bool
+	}{
+		{
+			name:                                "No reachability timeout (nil)",
+			reachabilityTimeout:                 nil,
+			expectKubernetesFeatureReachability: false,
+			expectErr:                           false,
+		},
+		{
+			name:                                "Reachability timeout set to 0",
+			reachabilityTimeout:                 ptrToUint32(0),
+			expectKubernetesFeatureReachability: true,
+			expectErr:                           false,
+		},
+		{
+			name:                                "Reachability timeout changed to 10",
+			reachabilityTimeout:                 ptrToUint32(10),
+			expectKubernetesFeatureReachability: true,
+			expectErr:                           false,
+		},
+		{
+			name:                                "Reachability timeout unchanged to 10",
+			reachabilityTimeout:                 ptrToUint32(10),
+			expectKubernetesFeatureReachability: true,
+			expectErr:                           false,
+		},
+		{
+			name:                                "Reachability timeout changed to 5",
+			reachabilityTimeout:                 ptrToUint32(5),
+			expectKubernetesFeatureReachability: true,
+			expectErr:                           false,
+		},
+		{
+			name:                                "Reachability timeout disabled",
+			reachabilityTimeout:                 nil,
+			expectKubernetesFeatureReachability: false,
+			expectErr:                           false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			crd := OVNKubernetesConfig.DeepCopy()
+			config := &crd.Spec
+			config.DefaultNetwork.OVNKubernetesConfig.EgressIPConfig.ReachabilityTotalTimeoutSeconds = tc.reachabilityTimeout
+
+			errs := validateOVNKubernetes(config)
+			g.Expect(errs).To(HaveLen(0))
+			fillDefaults(config, nil)
+
+			// at the same time we have an upgrade
+			t.Setenv("RELEASE_VERSION", "2.0.0")
+
+			bootstrapResult := fakeBootstrapResult()
+			bootstrapResult.OVN = bootstrap.OVNBootstrapResult{
+				ControlPlaneReplicaCount: 3,
+				OVNKubernetesConfig: &bootstrap.OVNConfigBoostrapResult{
+					DpuHostModeLabel:     OVN_NODE_SELECTOR_DEFAULT_DPU_HOST,
+					DpuModeLabel:         OVN_NODE_SELECTOR_DEFAULT_DPU,
+					SmartNicModeLabel:    OVN_NODE_SELECTOR_DEFAULT_SMART_NIC,
+					MgmtPortResourceName: "",
+					HyperShiftConfig: &bootstrap.OVNHyperShiftBootstrapResult{
+						Enabled: false,
+					},
+				},
+			}
+
+			featureGatesCNO := getDefaultFeatureGates()
+			fakeClient := cnofake.NewFakeClient()
+			// Set is as Hypershift hosted control plane.
+			bootstrapResult.Infra = bootstrap.InfraStatus{}
+			bootstrapResult.Infra.HostedControlPlane = &hypershift.HostedControlPlane{}
+			objs, _, err := renderOVNKubernetes(config, bootstrapResult, manifestDirOvn, fakeClient, featureGatesCNO)
+			if tc.expectErr {
+				g.Expect(err).To(HaveOccurred())
+				return
+			}
+			g.Expect(err).NotTo(HaveOccurred())
+
+			// Find the ovnkube-config ConfigMap and check the template data
+			var configMap *uns.Unstructured
+			for _, obj := range objs {
+				if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-config" {
+					configMap = obj
+					break
+				}
+			}
+			g.Expect(configMap).NotTo(BeNil(), "ovnkube-config ConfigMap should exist")
+
+			// Check the transport value in the rendered ConfigMap
+			configMapData, found, err := uns.NestedStringMap(configMap.Object, "data")
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(found).To(BeTrue(), "ConfigMap should have data field")
+			ovnkubeConf := configMapData["ovnkube.conf"]
+
+			var scriptCP string
+			var scriptNode string
+			for _, obj := range objs {
+				// Gets script that starts ovnkube-control-plane pod, ovnkube-cluster-manager container
+				if obj.GetKind() == "Deployment" && obj.GetName() == "ovnkube-control-plane" && obj.GetNamespace() == "openshift-ovn-kubernetes" {
+					containers, found, err := uns.NestedSlice(obj.Object, "spec", "template", "spec", "containers")
+					g.Expect(err).NotTo(HaveOccurred())
+					g.Expect(found).To(BeTrue())
+					for _, c := range containers {
+						cm := c.(map[string]interface{})
+						if name, ok := cm["name"]; ok && (name == "ovnkube-cluster-manager" || name == "ovnkube-control-plane") {
+							command, found, err := uns.NestedSlice(cm, "command")
+							g.Expect(err).NotTo(HaveOccurred())
+							g.Expect(found).To(BeTrue())
+							g.Expect(len(command)).To(BeNumerically(">", 2))
+							scriptCP = command[2].(string)
+							break
+						}
+					}
+				}
+
+				// Gets script that starts ovnkube-node pod, ovnkube-controller container
+				if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-script-lib" {
+					configMap = obj
+					configMapData, found, err := uns.NestedStringMap(configMap.Object, "data")
+					g.Expect(err).NotTo(HaveOccurred())
+					g.Expect(found).To(BeTrue(), "ovnkube-script-lib ConfigMap should have data field")
+					scriptNode = configMapData["ovnkube-lib.sh"]
+				}
+			}
+			g.Expect(scriptCP).NotTo(BeEmpty())
+			g.Expect(scriptNode).NotTo(BeEmpty())
+
+			if tc.expectKubernetesFeatureReachability {
+				g.Expect(ovnkubeConf).To(ContainSubstring("[ovnkubernetesfeature]"),
+					"ConfigMap should contain [ovnkubernetesfeature] section when enabled")
+				g.Expect(tc.reachabilityTimeout).NotTo(BeNil())
+				g.Expect(ovnkubeConf).To(
+					ContainSubstring(fmt.Sprintf("egressip-reachability-total-timeout=%d", *tc.reachabilityTimeout)),
+					"ConfigMap should contain the configured reachability timeout value",
+				)
+				g.Expect(ovnkubeConf).To(ContainSubstring("egressip-reachability-total-timeout="),
+					"ConfigMap should contain egressip-reachability-total-timeout=")
+
+				g.Expect(scriptCP).To(
+					ContainSubstring(fmt.Sprintf("--egressip-reachability-total-timeout %d", *tc.reachabilityTimeout)),
+					"ovnkube-control-plane pod template should contain the configured reachability timeout value",
+				)
+				g.Expect(scriptNode).To(
+					ContainSubstring(fmt.Sprintf("--egressip-reachability-total-timeout %d", *tc.reachabilityTimeout)),
+					"ovnkube-node pod template should contain the configured reachability timeout value",
+				)
+
+			} else {
+				g.Expect(ovnkubeConf).NotTo(ContainSubstring("egressip-reachability-total-timeout="),
+					"ConfigMap should not contain egressip-reachability-total-timeout= section when disabled")
+
+				g.Expect(scriptCP).NotTo(
+					ContainSubstring("--egressip-reachability-total-timeout"),
+					"ovnkube-control-plane pod template should not contain the configured reachability timeout value",
+				)
+				g.Expect(scriptNode).NotTo(
+					ContainSubstring("--egressip-reachability-total-timeout"),
+					"ovnkube-node pod template should not contain the configured reachability timeout value",
+				)
+			}
+		})
+	}
+}
+
 type fakeClientReader struct {
 	configMap *v1.ConfigMap
 }