Add free5GC as an example CNF#2377
Conversation
marketa-zejdova
requested review from
Smitholi67,
collivier,
martin-mat and
rich-l
as code owners
|
@marketa-zejdova could we leverage public helm charts instead of duplicating all files in our tree ? |
|
+ it would be great to cover this example cnf via gate jobs |
For now, I used a local copy of the free5GC Helm chart as a temporary solution. The upstream chart is still missing some changes needed for this deployment to work reliably (mainly MongoDB storage and kind compatibility). I also had to make a few adjustments on our side to get it running on kind. Because of that, I didn’t want to pull the chart directly from their development branch, as it could introduce breaking changes. I agree that copying the chart is not ideal long-term. Would it be better to reference a public Helm repository here, or possibly publish a stabilized version of this chart somewhere (if we have an internal Helm registry)? |
I agree this would be useful. We are planning to handle it in a follow-up PR. |
|
|
||
| Additionally, the following adjustments were made to container startup configuration: | ||
|
|
||
| - Removed the `/sbin/tini` entrypoint from multiple container deployments |
There was a problem hiding this comment.
Why exactly is this needed? What issues does this address? That does not make sense to me on a first glance.
| This example is intended as a **reference CNF deployment** for testing purposes and has several limitations: | ||
|
|
||
| - **Privileged networking requirements** | ||
| - The UPF requires advanced networking capabilities (e.g., IP forwarding) |
There was a problem hiding this comment.
Elaborate more in details what do you mean by this. What is impact on CNTi tests?
| - This may conflict with strict Kubernetes security policies | ||
|
|
||
| - **Potential CNTi test failures** | ||
| - Some certification tests (e.g., related to privileged containers or security contexts) may fail due to the networking requirements of free5GC |
There was a problem hiding this comment.
What do you mean "may fail"? We should know cert test execution results of Free5GC. Be more specific. List tests that fail and reasoning.
| kubeadmConfigPatches: | ||
| - | | ||
| kind: KubeletConfiguration | ||
| allowedUnsafeSysctls: |
There was a problem hiding this comment.
Does control plane really require this?
There was a problem hiding this comment.
Without the allowedUnsafeSysctls the upf pods fail after cnf_install with SysctlForbidden
marketa-zejdova
force-pushed
the
feature/free5gc-example-cnf
branch
from
40c9b18 to
7153c56
Compare
3 participants
Description
Introduce free5GC as an example CNF that is fully deployable and testable via the CNTi test suite.
Issues:
Refs: #2374
How has this been tested:
Types of changes:
Checklist:
Documentation
Code Review
Issue