controller: ACL correctly handles fragmented traffic. #239
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ovn-kubernetes | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| # Run Sunday at midnight | |
| - cron: '0 0 * * 0' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| env: | |
| OVNKUBE_COMMIT: "release-1.2" | |
| KIND_CLUSTER_NAME: ovn | |
| KIND_INSTALL_INGRESS: true | |
| KIND_ALLOW_SYSTEM_WRITES: true | |
| # This skips tests tagged as Serial | |
| # Current Serial tests are not relevant for OVN | |
| PARALLEL: true | |
| jobs: | |
| build: | |
| name: Build | |
| if: github.repository_owner == 'ovn-org' || github.event_name != 'schedule' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Enable Docker experimental features | |
| run: | | |
| echo $'{"experimental": true}' | sudo tee /etc/docker/daemon.json | |
| sudo service docker restart | |
| - name: Check out ovn | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Fix /etc/hosts file | |
| run: | | |
| . .ci/linux-util.sh | |
| fix_etc_hosts | |
| - name: Check out ovn-kubernetes | |
| uses: actions/checkout@v4 | |
| with: | |
| path: src/github.com/ovn-kubernetes/ovn-kubernetes | |
| repository: ovn-kubernetes/ovn-kubernetes | |
| ref: ${{ env.OVNKUBE_COMMIT }} | |
| - name: Prepare | |
| run: | | |
| .ci/ovn-kubernetes/prepare.sh src/github.com/ovn-kubernetes/ovn-kubernetes $GITHUB_ENV | |
| - name: Build ovn-kubernetes container | |
| run: | | |
| make -C src/github.com/ovn-kubernetes/ovn-kubernetes/dist/images \ | |
| IMAGE=ovn-daemonset-f:dev \ | |
| OVN_REPO=https://github.com/${{ github.repository }}.git \ | |
| OVN_GITREF=${{ github.ref_name }} fedora-image | |
| mkdir /tmp/_output | |
| docker save ovn-daemonset-f:dev > /tmp/_output/image.tar | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-image | |
| path: /tmp/_output/image.tar | |
| e2e: | |
| name: e2e | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 220 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Valid options are: | |
| # target: ["shard-conformance", "control-plane", "external-gateway" ] | |
| # shard-conformance: hybrid-overlay = multicast-enable = emptylb-enable = false | |
| # control-plane: hybrid-overlay = multicast-enable = emptylb-enable = true | |
| # ha: ["HA", "noHA"] | |
| # gateway-mode: ["local", "shared"] | |
| # ipfamily: ["ipv4", "ipv6", "dualstack"] | |
| # disable-snat-multiple-gws: ["noSnatGW", "snatGW"] | |
| # second-bridge: ["2br", "1br"] | |
| # ic: ["ic-disabled", "ic-single-node-zones", "ic-multi-node-zones"] | |
| # forwarding : ["", "disable-forwarding"] | |
| # network-segmentation : ["", "enable-network-segmentation"] | |
| include: | |
| - {"target": "shard-conformance", "ha": "HA", "gateway-mode": "local", "ipfamily": "ipv6", "disable-snat-multiple-gws": "snatGW", "ic": "ic-disabled"} | |
| - {"target": "shard-conformance", "ha": "HA", "gateway-mode": "local", "ipfamily": "dualstack", "disable-snat-multiple-gws": "snatGW", "ic": "ic-disabled"} | |
| - {"target": "shard-conformance", "ha": "HA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "snatGW", "ic": "ic-disabled"} | |
| - {"target": "shard-conformance", "ha": "HA", "gateway-mode": "shared", "ipfamily": "ipv6", "disable-snat-multiple-gws": "snatGW", "ic": "ic-disabled"} | |
| - {"target": "control-plane", "ha": "HA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "noSnatGW", "ic": "ic-disabled"} | |
| - {"target": "control-plane", "ha": "HA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "snatGW", "ic": "ic-disabled"} | |
| - {"target": "external-gateway", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "2br", "ic": "ic-single-node-zones"} | |
| - {"target": "external-gateway", "ha": "noHA", "gateway-mode": "local", "ipfamily": "ipv6", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"} | |
| - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "dualstack", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "forwarding": "disable-forwarding"} | |
| - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "local", "ipfamily": "dualstack", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"} | |
| - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "cni-mode": "unprivileged"} | |
| - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv6", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"} | |
| needs: [build] | |
| env: | |
| JOB_NAME: "${{ matrix.target }}-${{ matrix.ha }}-${{ matrix.gateway-mode }}-${{ matrix.ipfamily }}-${{ matrix.disable-snat-multiple-gws }}-${{ matrix.second-bridge }}" | |
| OVN_HYBRID_OVERLAY_ENABLE: "${{ matrix.target == 'control-plane' }}" | |
| KIND_INSTALL_METALLB: "${{ matrix.target == 'control-plane' || matrix.target == 'network-segmentation' }}" | |
| OVN_MULTICAST_ENABLE: "${{ matrix.target == 'control-plane' || matrix.target == 'network-segmentation'}}" | |
| OVN_EMPTY_LB_EVENTS: "${{ matrix.target == 'control-plane' }}" | |
| # TODO: We have been testing only non-interconnect ovn-k8s jobs until | |
| # now. We only enable interconnect mode for the external-gateway and | |
| # network-segmentation jobs. However, both modes should be tested in | |
| # the future, similar to what upstream ovn-k8s does. | |
| OVN_ENABLE_INTERCONNECT: "${{ matrix.ic == 'ic-single-node-zones' || matrix.ic == 'ic-multi-node-zones'}}" | |
| ENABLE_NETWORK_SEGMENTATION: "${{ matrix.target == 'network-segmentation' || matrix.network-segmentation == 'enable-network-segmentation' }}" | |
| OVN_HA: "${{ matrix.ha == 'HA' }}" | |
| OVN_DISABLE_SNAT_MULTIPLE_GWS: "${{ matrix.disable-snat-multiple-gws == 'noSnatGW' }}" | |
| OVN_GATEWAY_MODE: "${{ matrix.gateway-mode }}" | |
| OVN_SECOND_BRIDGE: "${{ matrix.second-bridge == '2br' }}" | |
| ENABLE_MULTI_NET: "${{ matrix.target == 'network-segmentation' }}" | |
| OVN_DISABLE_FORWARDING: "${{ matrix.forwarding == 'disable-forwarding' }}" | |
| PLATFORM_IPV4_SUPPORT: "${{ matrix.ipfamily == 'IPv4' || matrix.ipfamily == 'dualstack' }}" | |
| PLATFORM_IPV6_SUPPORT: "${{ matrix.ipfamily == 'IPv6' || matrix.ipfamily == 'dualstack' }}" | |
| ENABLE_PRE_CONF_UDN_ADDR: "${{ matrix.ic == 'ic-single-node-zones' && (matrix.target == 'network-segmentation' || matrix.network-segmentation == 'enable-network-segmentation') }}" | |
| ENABLE_NETWORK_CONNECT: "${{ matrix.target == 'network-segmentation' }}" | |
| OVN_UNPRIVILEGED_MODE: "${{ matrix.cni-mode == 'unprivileged' }}" | |
| MULTI_POD_SUBNET: true | |
| steps: | |
| - name: Check out ovn | |
| uses: actions/checkout@v4 | |
| - name: Fix /etc/hosts file | |
| run: | | |
| . .ci/linux-util.sh | |
| fix_etc_hosts | |
| - name: Install VRF kernel module | |
| run: | | |
| set -x | |
| sudo apt update | |
| sudo apt-get install linux-modules-extra-$(uname -r) -y | |
| sudo modprobe vrf | |
| - name: Free up disk space | |
| run: | | |
| . .ci/linux-util.sh | |
| free_up_disk_space_ubuntu | |
| - name: Check out ovn-kubernetes | |
| uses: actions/checkout@v4 | |
| with: | |
| path: src/github.com/ovn-kubernetes/ovn-kubernetes | |
| repository: ovn-kubernetes/ovn-kubernetes | |
| ref: ${{ env.OVNKUBE_COMMIT }} | |
| - name: Prepare | |
| run: | | |
| .ci/ovn-kubernetes/prepare.sh src/github.com/ovn-kubernetes/ovn-kubernetes $GITHUB_ENV | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache-dependency-path: "**/*.sum" | |
| id: go | |
| - name: Set up GOPATH | |
| run: | | |
| export GOPATH=$(go env GOPATH) | |
| echo "GOPATH=$GOPATH" >> $GITHUB_ENV | |
| echo "$GOPATH/bin" >> $GITHUB_PATH | |
| - name: Disable ufw | |
| # For IPv6 and Dualstack, ufw (Uncomplicated Firewall) should be disabled. | |
| # Not needed for KIND deployments, so just disable all the time. | |
| run: | | |
| sudo ufw disable | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: test-image | |
| - name: Load docker image | |
| run: | | |
| docker load --input image.tar && rm -rf image.tar | |
| - name: kind setup | |
| run: | | |
| export OVN_IMAGE="ovn-daemonset-f:dev" | |
| make -C test install-kind | |
| working-directory: src/github.com/ovn-kubernetes/ovn-kubernetes | |
| - name: Run Tests | |
| # e2e tests take ~60 minutes normally, 120 should be more than enough | |
| # set 3 hours for control-plane tests as these might take a while | |
| # give 10m extra to give ginkgo chance to timeout before github so that | |
| # we get its output. | |
| timeout-minutes: ${{ matrix.target == 'control-plane' && 190 || 130 }} | |
| run: | | |
| if [ "${{ matrix.target }}" == "external-gateway" ]; then | |
| make -C test control-plane WHAT="External Gateway" | |
| elif [ "${{ matrix.target }}" == "network-segmentation" ]; then | |
| make -C test control-plane WHAT="Network Segmentation" | |
| else | |
| make -C test ${{ matrix.target }} | |
| fi | |
| working-directory: src/github.com/ovn-kubernetes/ovn-kubernetes | |
| - name: Upload Junit Reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: kind-junit-${{ env.JOB_NAME }}-${{ github.run_id }} | |
| path: 'src/github.com/ovn-kubernetes/ovn-kubernetes/test/_artifacts/*.xml' | |
| - name: Export logs | |
| if: always() | |
| run: | | |
| mkdir -p /tmp/kind/logs | |
| kind export logs --name ${KIND_CLUSTER_NAME} --verbosity 4 /tmp/kind/logs | |
| working-directory: src/github.com/ovn-kubernetes/ovn-kubernetes | |
| - name: Upload logs | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: kind-logs-${{ env.JOB_NAME }}-${{ github.run_id }} | |
| path: /tmp/kind/logs |