CI: Remove IPv6 testing

When Ironic's CI went to Ubuntu Noble, IPv6 testing broke.
Ultimately, that was because the job was changed from BIOS
boot mode to UEFI.

Which in theory was a good thing.

But in reviewing the EDK2 known bugs[0], it is clear IPv6 testing
moving forward needs to be manual and cannot be done automatically.
For the reader's context, EDK2 is the source of the firmware used
for Libvirt UEFI VMs.

In attempting to work through the issues, we discovered:
- EDK2 doesn't care about stateless (auto discovery) mode, and
  thus doesn't work when that is set. It attempts to solicit
  an address, which is an open bug [1] from 2019, opened by
  an Ironic contributor.
- EDK2 *always* attempts PXE v4 first, which takes 60 seconds to
  timeout, before attempting PXE v6.
- PXE v6 *might* work before it times out, which takes 5 minutes to
  occur, if the dhcp server has cleared leases, but there is no
  guarentee. In most cases the result is the DHCP server views the
  address as handed out and that there are no free addresses available
  to supply. This is also rooted in bug [2], also opened in 2019.
- EDK2 then switches gears and tries HTTPBoot... simiarly, but
  the way it does so, noted in bug [3], is also incompatible
  with dnsmasq.

There are additional bugs, but one sort of gets the idea. Some of this
is compounded by aspects like dnsmasq attempting to be strict about
responding to requests in the DHCPv6 model. A different DHCP server
*might* demonstrate a little differently, but fundimentally the same
underlying issues in EDK2 will make testing difficult.

In attempting to fix this issue, we also attempted to revert back to
BIOS mode. This mode uses iPXE ROM images built for QEMU, yet we
quickly discovered these pre-built ROM images lacked IPv6 support
in Ubuntu Noble. This likely a regression of Ubuntu, but bug tracking
points directly to Upstream iPXE which is not valid as it is a compile
time option.

Testing the ROMs showed only DHCPv4 being attempted and IPv6 router
advertisements being entirely ignored. In a sense, if it did work,
it would still kind of be cheating as the iPXE ROM is able to skip
the first part of the complexity related to PXE in general.
In other words, it is not an entirely realistic test
when compared to Bare Metal.

As such, we don't have a forward path to "fix" this CI job as is.

We know the code works. We know vendor firmware sometimes has quarks like
needing stateless or stateful operation, We know Ironic does the
right thing... within it's capabilities. We just can't test this in
CI.

[0]: https://github.com/tianocore/edk2/issues?q=is%3Aissue%20state%3Aopen%20%20ipv6
[1]: https://github.com/tianocore/edk2/issues/9832
[2]: https://github.com/tianocore/edk2/issues/9828
[3]: https://github.com/tianocore/edk2/issues/9689

Change-Id: Ifc25bc1e1abb949892a1297a313d63f74937c9a1
This commit is contained in:
Julia Kreger 2025-01-23 11:22:14 -08:00
parent 3fb614f7b7
commit be2bd0ea04
5 changed files with 38 additions and 4 deletions

View File

@ -96,8 +96,10 @@ the Ironic service:
support for the switches attached to the baremetal servers so they can be
programmed. This interface generally requires use of ML2 plugins or other
Neutron SDN integrations to facilitate the port configuration actions in
the network fabric. When using IPv6, use of the ``neutron`` interface
is preferred.
the network fabric. When using IPv6, use of the ``neutron`` interface is
highly recommended as use of the ``dhcpv6-stateful`` configuration model
for IPv6 with Neutron also automatically creates multiple address records
for stateful address resolution.
To use these interfaces, they need to be enabled in *ironic.conf* utilizing
the :oslo.config:option:`enabled_network_interfaces` setting.

View File

@ -6,6 +6,13 @@ configuration. This page covers the IPv6 specifics only. Please refer to
:doc:`/install/configure-tenant-networks` and
:doc:`/install/configure-networking` for general networking configuration.
.. WARNING::
IPv6 Networking is not actively tested in upstream Continuous
Integration pipelines, in large part because test virtual machines
have limited support and known issues. Hardware vendors often have
better firmware which enables this functionality, but may require
specific operating modes, such as ``stateless`` or ``stateful``
depending on the requirements placed upon them by their customers.
Configure ironic PXE driver for provisioning using IPv6 addressing
==================================================================

View File

@ -0,0 +1,19 @@
---
issues:
- |
IPv6 testing in the upstream Continuous Integration (CI) pipelines has
been removed. This was the result of the move to UEFI booting in general,
combined with the the state of the EDK2 virtual machine firmware which
is known to have
`many issues with IPv6 <https://github.com/tianocore/edk2/issues?q=is%3Aissue%20state%3Aopen%20ipv6>`_,
and thus cannot be tested in an automated fashion upstream.
Previously Ironic tested IPv6 utilizing BIOS boot, but recent move to
leverage Ubuntu Noble in upstream CI also limited the community's
options as the BIOS ROM firmware images no longer contain IPv6 support.
As a result of this, we are forced to remove the CI job from testing.
We hope to restore this testing at some point in the future, should
EDK2 fix some of the known issues. This issue does not impact support
for physical machines which has long been validated as known working
through operator reports and downstream vendor testing activities.

View File

@ -874,6 +874,13 @@
SWIFT_TEMPURL_KEY: secretkey
IRONIC_BOOT_MODE: bios
# NOTE(TheJulia): This job does not work on Ubuntu Noble, much less
# newer EDK2 images when in UEFI mode. As such is being disabled.
# Reasons: EDK2 has a ton of ipv6 bugs. IPv6 support not in qemu/ipxe
# bios roms *either*. Concurrently, this means we can't test realistic
# deployment and booting, nor can we test a short circuited ipxe workflow
# upstream. In case this situation changes, keeping the job configuration
# below.
- job:
name: ironic-tempest-ipxe-ipv6
description: ironic-tempest-ipxe-ipv6
@ -930,6 +937,7 @@
BUILD_TIMEOUT: 2000
IRONIC_TEMPEST_BUILD_TIMEOUT: 2000
IRONIC_PING_TIMEOUT: 1440
IRONIC_BOOT_MODE: bios
# NOTE(rpittau): OLD TINYIPA JOBS
# Those jobs are used by other projects, we leave them here until

View File

@ -61,8 +61,6 @@
voting: false
- ironic-tempest-ipa-wholedisk-bios-ipmi-direct-dib:
voting: false
- ironic-tempest-ipxe-ipv6:
voting: false
- ironic-standalone-anaconda:
voting: false
- bifrost-integration-tinyipa-ubuntu-noble: