OCPBUGS-33921: infraconfig: allow VIPs outside machine networks for ELB

[mkowalski]

With this PR we are allowing VIPs to exist outside of defined machine networks if External Load Balancer is used.

Forcing this validation was an oversight as we already allow VIPs to be equal (API and Ingress using the same IP) for the ELB setups. As in principle it would be desired for people to feed Machine Networks with all subnets that are used (so they just append the VIP subnet if they use ELB), it makes some sense to soften the validation.

Fixes: OCPBUGS-33921

[openshift-ci-robot]

@mkowalski: This pull request references Jira Issue OCPBUGS-33921, which is invalid:

• expected the bug to be open, but it isn't
• expected the bug to target the "4.17.0" version, but no target version was set
• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Closed (Won't Do) instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

With this PR we are allowing VIPs to exist outside of defined machine networks if External Load Balancer is used.

Forcing this validation was an oversight as we already allow VIPs to be equal (API and Ingress using the same IP) for the ELB setups. As in principle it would be desired for people to feed Machine Networks with all subnets that are used (so they just append the VIP subnet if they use ELB), it makes some sense to soften the validation.

Fixes: OCPBUGS-33921

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[mkowalski]

/jira refresh
/cherry-pick release-4.16

[openshift-cherrypick-robot]

@mkowalski: once the present PR merges, I will cherry-pick it on top of release-4.16 in a new PR and assign it to you.

In response to this:

/jira refresh
/cherry-pick release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@mkowalski: This pull request references Jira Issue OCPBUGS-33921, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.17.0) matches configured target version for branch (4.17.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @zhaozhanqi

In response to this:

/jira refresh
/cherry-pick release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[zhaozhanqi]

pre-merge testing this PR,

sounds like network operator the errors: see
https://qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/view/gs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-4.16-multi-nightly-baremetal-ipi-ovn-ipv4-external-lb-f7/1795060149895827456

[mkowalski]

Interesting, the code path with Error on validating API VIPs and Machine Networks should not be triggered if you have Status.PlatformStatus.BareMetal.LoadBalancer.Type == configv1.LoadBalancerTypeUserManaged so I will need to dig deeper into your run.

As I am intermittently off, could you please save must-gather from your test run aside for me so that it's not lost?

[zhaozhanqi]

Interesting, the code path with Error on validating API VIPs and Machine Networks should not be triggered if you have Status.PlatformStatus.BareMetal.LoadBalancer.Type == configv1.LoadBalancerTypeUserManaged so I will need to dig deeper into your run.

As I am intermittently off, could you please save must-gather from your test run aside for me so that it's not lost?

must-gather should be here

[zhaozhanqi]

Retest this PR, looks good.
/label qe-approved

[openshift-ci-robot]

@mkowalski: This pull request references Jira Issue OCPBUGS-33921, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.17.0) matches configured target version for branch (4.17.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @zhaozhanqi

In response to this:

With this PR we are allowing VIPs to exist outside of defined machine networks if External Load Balancer is used.

Forcing this validation was an oversight as we already allow VIPs to be equal (API and Ingress using the same IP) for the ELB setups. As in principle it would be desired for people to feed Machine Networks with all subnets that are used (so they just append the VIP subnet if they use ELB), it makes some sense to soften the validation.

Fixes: OCPBUGS-33921

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[zhaozhanqi]

/lgtm

[mkowalski]

/retest

[mkowalski]

/test e2e-vsphere-ovn-dualstack-primaryv6

[mkowalski]

/retest

[mkowalski]

/test e2e-metal-ipi-ovn-ipv6

[mkowalski]

/retest

[zhaozhanqi]

this PR need to be approved. cc @mkowalski

[mkowalski]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mkowalski, zhaozhanqi
Once this PR has been reviewed and has the lgtm label, please assign fepan for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mkowalski]

/hold

I don't necessarily want to merge it

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[mkowalski]

/remove-lifecycle stale
/lifecycle frozen

[openshift-ci]

@mkowalski: The lifecycle/frozen label cannot be applied to Pull Requests.

In response to this:

/remove-lifecycle stale
/lifecycle frozen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@mkowalski: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-network-migration	4065654	link	true	/test e2e-aws-ovn-network-migration
ci/prow/e2e-vsphere-ovn-dualstack-primaryv6	4065654	link	false	/test e2e-vsphere-ovn-dualstack-primaryv6
ci/prow/security	4065654	link	false	/test security
ci/prow/hypershift-e2e-aks	4065654	link	true	/test hypershift-e2e-aks

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.