Skip to content

Commit d9b4a8d

Browse files
hareeshpchareeshpc
committed
feat: enable OVN kube identity in DPF Helm charts and fix DPU bootstrap identity flow
- Wire global.enableOvnKubeIdentity across DPF OVN manifests and enable OVN_ENABLE_OVNKUBE_IDENTITY for host and DPU paths. - Add ovnkube-identity resources in DPF charts (SA/RBAC/webhooks/daemonset) for CSR approval and admission checks. - Implement DPU bootstrap kubeconfig generation with host-API impersonation and required RBAC for DPU service accounts. - Ensure DPU OVN containers get K8S_NODE_DPU with normalized node input to avoid empty or mismatched cert-manager node names.
1 parent ca4108c commit d9b4a8d

File tree

7 files changed

+358
-6
lines changed

7 files changed

+358
-6
lines changed

‎helm/ovn-kubernetes-dpf/templates/common.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,16 @@ rules:
8787
- egressservices
8888
- adminpolicybasedexternalroutes
8989
verbs: [ "get", "list", "watch" ]
90+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
91+
- apiGroups: ["certificates.k8s.io"]
92+
resources:
93+
- certificatesigningrequests
94+
verbs:
95+
- create
96+
- get
97+
- list
98+
- watch
99+
{{- end }}
90100
- apiGroups: [""]
91101
resources:
92102
- events
@@ -129,4 +139,4 @@ rules:
129139
verbs:
130140
- get
131141
- create
132-
{{- end }}
142+
{{- end }}

‎helm/ovn-kubernetes-dpf/templates/dpu-manifests.yaml‎

Lines changed: 88 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- $identityEnabled := hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false -}}
2+
{{- $useSecretBootstrap := and $identityEnabled (ne (default "" .Values.dpuManifests.kubernetesSecretName) "") -}}
13
{{- if .Values.dpuManifests.enabled }}
24
---
35
apiVersion: v1
@@ -53,9 +55,15 @@ roleRef:
5355
kind: ClusterRole
5456
apiGroup: rbac.authorization.k8s.io
5557
subjects:
58+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
59+
- kind: Group
60+
name: system:ovn-nodes
61+
apiGroup: rbac.authorization.k8s.io
62+
{{- else }}
5663
- kind: ServiceAccount
5764
name: {{ include "ovn-kubernetes.fullname" . }}-node
5865
namespace: {{ .Release.Namespace }}
66+
{{- end }}
5967
---
6068
apiVersion: rbac.authorization.k8s.io/v1
6169
kind: ClusterRoleBinding
@@ -80,9 +88,15 @@ roleRef:
8088
kind: Role
8189
apiGroup: rbac.authorization.k8s.io
8290
subjects:
91+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
92+
- kind: Group
93+
name: system:ovn-nodes
94+
apiGroup: rbac.authorization.k8s.io
95+
{{- else }}
8396
- kind: ServiceAccount
8497
name: {{ include "ovn-kubernetes.fullname" . }}-node
8598
namespace: {{ .Release.Namespace }}
99+
{{- end }}
86100
---
87101
apiVersion: rbac.authorization.k8s.io/v1
88102
kind: RoleBinding
@@ -176,6 +190,55 @@ spec:
176190
automountServiceAccountToken: false
177191
# DPU CNI provisioner
178192
initContainers:
193+
{{- if $useSecretBootstrap }}
194+
- name: ovnkube-bootstrap-kubeconfig
195+
image: {{ .Values.dpuManifests.image.repository }}:{{ .Values.dpuManifests.image.tag }}
196+
imagePullPolicy: {{ .Values.dpuManifests.image.pullPolicy }}
197+
command:
198+
- /bin/sh
199+
- -ec
200+
- |
201+
cat <<EOF >/host-kubernetes/kubelet.conf
202+
apiVersion: v1
203+
kind: Config
204+
clusters:
205+
- cluster:
206+
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
207+
server: ${K8S_APISERVER}
208+
name: host-cluster
209+
contexts:
210+
- context:
211+
cluster: host-cluster
212+
user: ovn-dpu-bootstrap
213+
name: ovn-dpu-bootstrap
214+
current-context: ovn-dpu-bootstrap
215+
users:
216+
- name: ovn-dpu-bootstrap
217+
user:
218+
tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
219+
as: system:node:${K8S_NODE_DPU%%-mt*}
220+
as-groups:
221+
- system:nodes
222+
- system:authenticated
223+
EOF
224+
chmod 0600 /host-kubernetes/kubelet.conf
225+
env:
226+
- name: K8S_NODE_DPU
227+
valueFrom:
228+
fieldRef:
229+
fieldPath: spec.nodeName
230+
- name: K8S_APISERVER
231+
valueFrom:
232+
configMapKeyRef:
233+
name: {{ include "ovn-kubernetes.fullname" . }}-config
234+
key: k8s_apiserver
235+
volumeMounts:
236+
- mountPath: /host-kubernetes
237+
name: host-kubeconfig
238+
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
239+
name: tenant-cluster-access-secret
240+
readOnly: true
241+
{{- end }}
179242
{{- if not .Values.dpuManifests.externalDHCP }}
180243
- name: ipallocator
181244
image: {{ .Values.dpuManifests.imagedpf.repository }}:{{ .Values.dpuManifests.imagedpf.tag }}
@@ -501,7 +564,12 @@ spec:
501564
- name: doca-ovnkube-controller
502565
image: {{ .Values.dpuManifests.image.repository }}:{{ .Values.dpuManifests.image.tag }}
503566
imagePullPolicy: {{ .Values.dpuManifests.image.pullPolicy }}
504-
command: ["/root/ovnkube.sh", "ovnkube-controller-with-node"]
567+
command:
568+
- /bin/sh
569+
- -ec
570+
- |
571+
export K8S_NODE_DPU="${K8S_NODE_DPU%%-mt*}"
572+
exec /root/ovnkube.sh ovnkube-controller-with-node
505573
securityContext:
506574
runAsUser: 0
507575
privileged: true
@@ -604,6 +672,10 @@ spec:
604672
valueFrom:
605673
fieldRef:
606674
fieldPath: spec.nodeName
675+
- name: K8S_NODE_DPU
676+
valueFrom:
677+
fieldRef:
678+
fieldPath: spec.nodeName
607679
- name: K8S_NODE_IP
608680
valueFrom:
609681
fieldRef:
@@ -702,7 +774,7 @@ spec:
702774
- name: OVN_ENABLE_MULTI_EXTERNAL_GATEWAY
703775
value: "false"
704776
- name: OVN_ENABLE_OVNKUBE_IDENTITY
705-
value: "false"
777+
value: {{ hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false | quote }}
706778
- name: OVN_DISABLE_REQUESTEDCHASSIS
707779
value: {{ default "false" .Values.dpuManifests.ovnDisableRequestedchassis | quote }}
708780
- name: OVN_ENABLE_SVC_TEMPLATE_SUPPORT
@@ -726,7 +798,12 @@ spec:
726798
- name: ovn-controller
727799
image: {{ .Values.dpuManifests.image.repository }}:{{ .Values.dpuManifests.image.tag }}
728800
imagePullPolicy: {{ .Values.dpuManifests.image.pullPolicy }}
729-
command: ["/root/ovnkube.sh", "ovn-controller"]
801+
command:
802+
- /bin/sh
803+
- -ec
804+
- |
805+
export K8S_NODE_DPU="${K8S_NODE_DPU%%-mt*}"
806+
exec /root/ovnkube.sh ovn-controller
730807
securityContext:
731808
runAsUser: 0
732809
capabilities:
@@ -761,6 +838,10 @@ spec:
761838
configMapKeyRef:
762839
name: {{ include "ovn-kubernetes.fullname" . }}-config
763840
key: k8s_apiserver
841+
- name: K8S_NODE_DPU
842+
valueFrom:
843+
fieldRef:
844+
fieldPath: spec.nodeName
764845
- name: OVN_KUBERNETES_NAMESPACE
765846
valueFrom:
766847
fieldRef:
@@ -845,8 +926,12 @@ spec:
845926
hostPath:
846927
path: /var/run/dbus
847928
- name: host-kubeconfig
929+
{{- if $useSecretBootstrap }}
930+
emptyDir: {}
931+
{{- else }}
848932
hostPath:
849933
path: /etc/kubernetes/
934+
{{- end }}
850935
- name: host-kubelet
851936
hostPath:
852937
path: /var/lib/kubelet

‎helm/ovn-kubernetes-dpf/templates/host-with-dpu-manifests.yaml‎

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,15 @@ roleRef:
1515
kind: ClusterRole
1616
apiGroup: rbac.authorization.k8s.io
1717
subjects:
18+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
19+
- kind: Group
20+
name: system:ovn-nodes
21+
apiGroup: rbac.authorization.k8s.io
22+
{{- else }}
1823
- kind: ServiceAccount
1924
name: {{ include "ovn-kubernetes.fullname" . }}-node-dpu-host
2025
namespace: {{ .Release.Namespace }}
26+
{{- end }}
2127
- kind: ServiceAccount
2228
name: {{ .Values.nodeWithDPUManifests.dpuServiceAccountName }}
2329
namespace: {{ .Values.nodeWithDPUManifests.dpuServiceAccountNamespace }}
@@ -37,6 +43,45 @@ subjects:
3743
- kind: ServiceAccount
3844
name: {{ .Values.nodeWithDPUManifests.dpuServiceAccountName }}
3945
namespace: {{ .Values.nodeWithDPUManifests.dpuServiceAccountNamespace }}
46+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
47+
---
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
kind: ClusterRole
50+
metadata:
51+
name: {{ include "ovn-kubernetes.fullname" . }}-node-dpu-host-impersonator
52+
rules:
53+
- apiGroups: [""]
54+
resources:
55+
- users
56+
verbs:
57+
- impersonate
58+
- apiGroups: [""]
59+
resources:
60+
- groups
61+
resourceNames:
62+
- system:nodes
63+
- system:authenticated
64+
verbs:
65+
- impersonate
66+
---
67+
apiVersion: rbac.authorization.k8s.io/v1
68+
kind: ClusterRoleBinding
69+
metadata:
70+
name: {{ include "ovn-kubernetes.fullname" . }}-node-dpu-host-impersonator
71+
roleRef:
72+
name: {{ include "ovn-kubernetes.fullname" . }}-node-dpu-host-impersonator
73+
kind: ClusterRole
74+
apiGroup: rbac.authorization.k8s.io
75+
subjects:
76+
- kind: ServiceAccount
77+
name: {{ .Values.nodeWithDPUManifests.dpuServiceAccountName }}
78+
namespace: {{ .Values.nodeWithDPUManifests.dpuServiceAccountNamespace }}
79+
{{- if ne (default "" .Values.dpuManifests.kubernetesSecretName) "" }}
80+
- kind: ServiceAccount
81+
name: {{ .Values.dpuManifests.kubernetesSecretName }}
82+
namespace: {{ .Release.Namespace }}
83+
{{- end }}
84+
{{- end }}
4085
---
4186
apiVersion: rbac.authorization.k8s.io/v1
4287
kind: RoleBinding
@@ -48,9 +93,15 @@ roleRef:
4893
kind: Role
4994
apiGroup: rbac.authorization.k8s.io
5095
subjects:
96+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
97+
- kind: Group
98+
name: system:ovn-nodes
99+
apiGroup: rbac.authorization.k8s.io
100+
{{- else }}
51101
- kind: ServiceAccount
52102
name: {{ include "ovn-kubernetes.fullname" . }}-node-dpu-host
53103
namespace: {{ .Release.Namespace }}
104+
{{- end }}
54105
---
55106
apiVersion: rbac.authorization.k8s.io/v1
56107
kind: RoleBinding
@@ -255,7 +306,7 @@ spec:
255306
- name: OVN_EX_GW_NETWORK_INTERFACE
256307
value: ""
257308
- name: OVN_ENABLE_OVNKUBE_IDENTITY
258-
value: "false"
309+
value: {{ hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false | quote }}
259310
- name: OVN_ENABLE_INTERCONNECT
260311
value: "true"
261312
- name: OVNKUBE_NODE_MODE

‎helm/ovn-kubernetes-dpf/templates/host-without-dpu-manifests.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,15 @@ roleRef:
1515
kind: ClusterRole
1616
apiGroup: rbac.authorization.k8s.io
1717
subjects:
18+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
19+
- kind: Group
20+
name: system:ovn-nodes
21+
apiGroup: rbac.authorization.k8s.io
22+
{{- else }}
1823
- kind: ServiceAccount
1924
name: {{ include "ovn-kubernetes.fullname" . }}-node
2025
namespace: {{ .Release.Namespace }}
26+
{{- end }}
2127
---
2228
apiVersion: rbac.authorization.k8s.io/v1
2329
kind: ClusterRoleBinding
@@ -42,9 +48,15 @@ roleRef:
4248
kind: Role
4349
apiGroup: rbac.authorization.k8s.io
4450
subjects:
51+
{{- if eq (hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false) true }}
52+
- kind: Group
53+
name: system:ovn-nodes
54+
apiGroup: rbac.authorization.k8s.io
55+
{{- else }}
4556
- kind: ServiceAccount
4657
name: {{ include "ovn-kubernetes.fullname" . }}-node
4758
namespace: {{ .Release.Namespace }}
59+
{{- end }}
4860
---
4961
apiVersion: rbac.authorization.k8s.io/v1
5062
kind: RoleBinding
@@ -491,7 +503,7 @@ spec:
491503
- name: OVN_ENABLE_MULTI_EXTERNAL_GATEWAY
492504
value: "false"
493505
- name: OVN_ENABLE_OVNKUBE_IDENTITY
494-
value: "false"
506+
value: {{ hasKey .Values.global "enableOvnKubeIdentity" | ternary .Values.global.enableOvnKubeIdentity false | quote }}
495507
- name: OVN_ENABLE_SVC_TEMPLATE_SUPPORT
496508
value: "false"
497509
- name: OVN_ENABLE_DNSNAMERESOLVER

0 commit comments

Comments
 (0)