36 Commits

Author SHA1 Message Date
Andrii Ostapenko
824f168efc Undo octal-values restriction together with corresponding code
Unrestrict octal values rule since benefits of file modes readability
exceed possible issues with yaml 1.2 adoption in future k8s versions.
These issues will be addressed when/if they occur.

Also ensure osh-infra is a required project for lint job, that matters
when running job against another project.

Change-Id: Ic5e327cf40c4b09c90738baff56419a6cef132da
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-07-07 15:42:53 +00:00
Andrii Ostapenko
83e27e600c Enable key-duplicates and octal-values yamllint checks
With corresponding code changes.

Change-Id: I11cde8971b3effbb6eb2b69a7d31ecf12140434e
2020-06-17 13:14:30 -05:00
Zuul
e53d28718d Merge "Remove OSH Authors copyright" 2020-05-12 20:00:38 +00:00
diwakar thyagaraj
d2e48fc131 Enable Apparmor to openvswitch init pods
Change-Id: Ib71f7e4a2ea21efaa648ddf13a8ee3378609deb2
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
2020-05-11 14:27:57 +00:00
Gage Hugo
d14d826b26 Remove OSH Authors copyright
The current copyright refers to a non-existent group
"openstack helm authors" with often out-of-date references that
are confusing when adding a new file to the repo.

This change removes all references to this copyright by the
non-existent group and any blank lines underneath.

Change-Id: I1882738cf9757c5350a8533876fd37b5920b5235
2020-05-07 02:11:15 +00:00
rajesh.kudaka
f2b8bacb26 Set ctl socket ownership
This is moved from neutron-ovs-agent init script[0] to
openvswitch poststart to ensure that ovs ctl socket
has the required permissions even if the openvswitch
pods are restarted.

[0] https://github.com/openstack/openstack-helm/blob/master/neutron/templates/bin/_neutron-openvswitch-agent-init.sh.tpl#L22-L25

Change-Id: I09e604576e2408a8dec9905d1ad070422351ed99
2020-04-27 15:06:01 +00:00
Hemachandra Reddy
b5c12377da Fixes the pod prestop hook
Change-Id: I94988da32bdcf2d1a947abecf4faa8cd84a54741
2020-03-23 23:45:04 +00:00
diwakar thyagaraj
c4b2be6bcc Enable AppArmor profile to Openvswitch.
This adds Apparmor profile to Openvswitch. This change also refactors
the apparmor job to utilize the feature gates system instead of relying
on separate scripts

Change-Id: Ie53162cfdea5553191d3b5dbdfec195e4001b255
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
2020-03-17 16:39:54 +00:00
Reddy, Hemachandra (hr858f)
70d93625e8 Do not set CPU resources to ovs-vswitch DPDK pod
When DPDK is enbaled, configuring CPU resource limits
through Kubernetes affects packet throughput adversely.
DPDK PMD cores could not get 100% busy.

They need to be configured by isolating them in host grub
and later through PMD core mask.

Change-Id: Ia80880302b9c5c02fdb1c00cb62f6640860e898e
2020-01-21 23:10:39 +00:00
Pete Birley
601e6ca47a OVS: enable setting threads for handler and revalidator
This PS enables the ability to configure the handler and
revalidator threads.

See: https://bugs.launchpad.net/ubuntu/+source/openvswitch/+bug/1827264/comments/6
Change-Id: I789da34104ac3cfb6a38bf4435a652da45c55e63
Signed-off-by: Pete Birley <pete@port.direct>
2020-01-15 17:07:24 -06:00
Roy Tang
9a8516867a Add support to set vhost-iommu-support as global option
Also update other optional parm

Change-Id: I9a36acd6a331255d01722ed5961b08e1fbca80d1
2019-12-09 22:19:21 +00:00
Zuul
385803eef2 Merge "Fix OVS-DPDK readiness probe for OVS < v2.10.0" 2019-12-08 20:54:19 +00:00
Hemachandra Reddy
066a7e0ab4 Initialize PCI module if used before DPDK for hotplug to work
Change-Id: I9f552035eb70fd2a828ff7fa4852ba66055b885f
2019-12-06 15:56:14 +00:00
Georg Kunz
cd27f2714c Fix OVS-DPDK readiness probe for OVS < v2.10.0
A recently introduced readiness probe for OVS with DPDK makes use of an
OVSDB table entry 'dpdk_initialized' which does not exist in OVS
versions preceeding v2.10.0. This patch changes the readiness probe to
exit successfully if this table entry does not exit.

Change-Id: I1776ac4bf736220267a49042f1b7092f3cf5ed16
2019-12-03 16:48:13 +00:00
Hemachandra Reddy
926348fe24 Add DPDK check for readiness probe
This change makes sure that "ovs-vsctl get Open_vSwitch .
dpdk_initialized" is true before making the pod ready

Change-Id: Ie88f74a1e7a84afb3fbca55b500009255b4f6991
2019-10-07 16:08:13 +00:00
Deepak Tiwari
e354bef7bb ovs-dpdk: create separate cgroup for openvswitch-vswitchd pods
Setup Cgroup to use to break out of Kubernetes defined groups for ovs-dpdk pods.
All the cores on the server are added to the cpuset, pmd_cpu_mask and lcore_mask
will choose the right ones for ovs-dpdk from all the cores.

Co-Authored-By: Phil Sphicas <ps3910@att.com>

Change-Id: Ia840647e3fc09480b826b3075b2585daefa638b3
2019-09-13 12:22:31 -05:00
Georg Kunz
c0dda7785f Aligning OVS and Neutron configuration for DPDK
This change aligns DPDK configuration parameters across the OVS and Neutron
charts.

Change-Id: I381286a49dfe65762cfb4a344e7bd178e42f10f6
2019-08-28 14:29:04 +00:00
rajesh.kudaka
2b66685594 Enable probes override from values.yaml for ovs
This commit enables overriding liveness/readiness probes
configurations for openvswitch pods from values.yaml

Change-Id: I4ec2b9e88bf8ed57e8ac9293f333969b63cef335
2019-08-19 16:34:03 +00:00
Alexander Noskov
3b5a1c7909 Take dnsPolicy from .Values.pod.dns_policy variable
Change-Id: Iae7caa5bdefe7749231c031c6003591a6251fa97
2019-07-15 17:31:16 +00:00
Georg Kunz
e6530bc2bb Extended OVS chart with support for DPDK
Extending the Openvswitch chart with support for DPDK. In order to
enable DPDK support, set the dpdk:enabled option to true in value.yaml.
Prerequisites for successfully running OVS with DPDK: the host OS must
to have hugepages enabled.

Co-Authored-By: Rihab Banday <rihab.banday@ericsson.com>

Change-Id: I9649832511ba7c7ba7c391555d60171ef9264110
2019-07-09 17:10:15 +02:00
Jian Li
0146cf98ba Open openvswitch_db_server port 6640 to interact with SDN controller
This change allows the openvswitch to interact with SDN controller
(e.g., ONOS, ODL) through 6640 port.

Story: 2005763
Task: 33473

Change-Id: Ifcbb6a157c230fa729d295ef0d3fb9a16fff60a2
2019-06-24 09:33:11 +09:00
Jagan Kavva
34d691c9b1 Add docker-default (enforce) AppArmor profile to openvswitch
Change-Id: I7b091f668d9293d7eafd9c1b54c4eab715bbd93c
2019-04-29 09:24:41 -05:00
Pete Birley
358af71da7 OpenvSwitch: use security context macros
This PS updates to use security context macros from HTK, in line
with other charts.

Change-Id: I5ca0af17eccc4856baef871cf199554aad075ebe
Signed-off-by: Pete Birley <pete@port.direct>
2019-04-21 04:16:50 +00:00
Pete Birley
d83ab26d04 OvS: Improve security options for ovs-db pod
This PS improves the securityu options for the ovs-db pod
by specifying running as a non-root user, using read only
filesystems for the containers and also preventing
privilege escalation. A subsequent ps will move to use the
helm toolkit functions that allow the control of these params.

Change-Id: I94fbf5b851be68f6fb4a1f9809ad12776e8a80b3
Signed-off-by: Pete Birley <pete@port.direct>
2019-04-21 03:16:46 +00:00
Pete Birley
2abf62ff4d OSH-Infra: Add emptydirs for tmp
This PS adds emptydirs backing the /tmp directory in pods, which
is required in most cases for full operation when using a read only
filesystem backing the container.

Additionally some yaml indent issues are resolved.

Change-Id: I8b7f1614da059783254aa6efc09facf23fca3cad
Signed-off-by: Pete Birley <pete@port.direct>
2019-04-20 20:50:59 +00:00
Rahul Khiyani
3995e7d3de Revert "readOnlyRootFilesystem: true for openvswitch chart"
I believe when we have set the readOnly flag at pod without HTK functionality the changes were not reflected. That is why it passed the gate.

Later with HTK functionality the gates never passed and I have tested that in various ways and finally I had to unset the readOnly flag

This reverts commit 598040bea05737ea1ee2460ba8675ed7c061e63a.

Change-Id: Icf8d3cc60045926ab60b9735ee1e8202c15df9d5
2019-04-16 02:28:32 +00:00
Steve Wilkerson
84f30ec103 Add release-annotation to pod spec, add missing annotations
This adds the release-annotation to the pod spec for the charts in
openstack-helm-infra. This also adds missing configmap annotations
to charts in openstack-helm-infra

Change-Id: Ie23f0c16a7a21d3929e98928db2bbcef69ae6490
2019-03-21 09:10:48 -05:00
Rahul Khiyani
598040bea0 readOnlyRootFilesystem: true for openvswitch chart
Fix for adding readOnlyRootFilesystem flag at pod
level

Change-Id: If0943518bdec0d950c50c90aa89929d1a42aa0a0
2019-03-06 04:36:02 +00:00
bk160f
7c7d7eb7dd ReadinessProbe for OVS-DB Pod
This implementation is to add readiness probe to ovs-db pod.
The goal is to check if the db.sock is connected by executing ovs-vsctl
command to list the Open_vswitch configuration table.

Change-Id: Idd4382d95d07ffff94a30bcb7ac132b88e9d6de1
2019-02-09 03:16:16 +00:00
Hemachandra Reddy
aef0ff7810 Liveness probes for OpenVSwitch daemons.
Uses ovs-vsctl for ovs-db
Uses ovs-appctl for ovs-vswitchd as "ovs-vsctl show" does not
talk to ovs-vswitchd.

Change-Id: Ia0b84e3546ff1693676ca61370e1344d75b6e308
2019-01-29 20:10:41 +00:00
Pete Birley
6a9c16862a OpenvSwitch: Share container PID namespaces under docker
This PS shares pid namespaces for containers in pods under docker,
bringing running in this runtime inline with other runc based container
backends, allowing the pause process in the pod to act as a reaper.

Change-Id: I1e511b1cd11a4b2f4818a772a91e8a8dfd342be3
Signed-off-by: Pete Birley <pete@port.direct>
2018-12-14 04:52:39 +00:00
Zuul
21f46d294b Merge "[Open vSwitch] Remove auto_bridge_add support" 2018-10-17 04:23:52 +00:00
Tin Lam
92e68d33ea Add network policy toolkit function
This patch set implements the helm toolkit function to generate a
kubernetes network policy manifest based on overrideable values.
This also adds a chart that shuts down all the ingress and egress
traffics in the namespace. This can be used to ensure the
whitelisted network policy works as intended.

Additionally, implementation is done for some infrastructure charts.

Change-Id: I78e87ef3276e948ae4dd2eb462b4b8012251c8c8
Co-Authored-By: Mike Pham <tp6510@att.com>
Signed-off-by: Tin Lam <tin@irrational.io>
2018-10-15 13:50:50 +00:00
Chris Wedgwood
6b8de2955f [Open vSwitch] Remove auto_bridge_add support
We have two functionally identical places where we add bridges, one in
the neutron chart and one in the openvswitch chart.

It makes more sense to do it only in the neutron chart as that aligns
with the linux_bridge configuration and also is where the
bridge_mappings are specified.

Change-Id: I655380b021b89c3d93475febf7daca8f9d88cc54
2018-10-06 05:15:56 +00:00
Pete Birley
bb3ff98d53 Add release uuid to pods and rc objects
This PS adds the ability to attach a release uuid to pods and rc
objects as desired. A follow up ps will add the ability to add arbitary
annotations to the same objects.

Change-Id: Iceedba457a03387f6fc44eb763a00fd57f9d84a5
Signed-off-by: Pete Birley <pete@port.direct>
2018-09-13 05:35:35 +00:00
Steve Wilkerson
3dcbfae101 Openvswitch: Move chart to openstack-helm-infra
This moves the openvswitch chart to openstack-helm-infra as part of
the effort to move charts to their appropriate repositories

Change-Id: I6e00231b8de54c01bc9bb31e0433753a9f281542
Story: 2002204
Task: 21730
2018-09-07 12:35:40 +00:00