OCPBUGS-55962: Provide config map to force loose isolation for UDN networks #2714

pperiyasamy · 2025-05-21T17:03:27Z

This PR adds support for configuring loose isolation mode for the BGP advertised UDN networks. The config map with name openshift-network-operator/udn-config-overrides must be created with force-loose-isolation key set to true which rolls out the loose mode by recreating ovnkube-node daemonset pods.

Steps to roll out loose isolation mode:

Create a below config map.

kind: ConfigMap
apiVersion: v1
metadata:
  name: udn-config-overrides
  namespace: openshift-network-operator
data:
  force-loose-isolation: "true"

Wait for ovnkube-node DS rollout to complete.
Create BGP advertised UDN networks.

This commit provides support for configuring loose isolation mode for the BGP advertised UDN networks. The config map with name openshift-network-operator/udn-config-overrides must be created with "force-loose-isolation" key set to "true" which rolls out the loose mode by recreating ovnkube-node daemonset pods. Signed-off-by: Periyasamy Palanisamy <[email protected]>

openshift-ci · 2025-05-21T17:04:08Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pperiyasamy
Once this PR has been reviewed and has the lgtm label, please assign trozet for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2025-05-22T08:47:24Z

@pperiyasamy: This pull request references Jira Issue OCPBUGS-55962, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.0) matches configured target version for branch (4.20.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @zhaozhanqi

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This PR adds support for configuring loose isolation mode for the BGP advertised UDN networks. The config map with name openshift-network-operator/udn-config-overrides must be created with force-loose-isolation key set to true which rolls out the loose mode by recreating ovnkube-node daemonset pods.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pperiyasamy · 2025-05-22T08:55:59Z

/retest

pperiyasamy · 2025-05-22T08:56:20Z

/assign @kyrtapz @jcaamano

pperiyasamy · 2025-05-28T16:20:09Z

/retest

openshift-ci-robot · 2025-05-28T16:27:11Z

@pperiyasamy: This pull request references Jira Issue OCPBUGS-55962, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.0) matches configured target version for branch (4.20.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @Meina-rh

In response to this:

This PR adds support for configuring loose isolation mode for the BGP advertised UDN networks. The config map with name openshift-network-operator/udn-config-overrides must be created with force-loose-isolation key set to true which rolls out the loose mode by recreating ovnkube-node daemonset pods.

Steps to roll out loose isolation mode:

Create a below config map.
kind: ConfigMap
apiVersion: v1
metadata:
 name: udn-config-overrides
 namespace: openshift-network-operator
data:
 force-loose-isolation: "true"
Wait for ovnkube-node DS rollout to complete.

Create BGP advertised UDN networks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pperiyasamy · 2025-05-28T16:28:08Z

/assign @Meina-rh @anuragthehatter @jechen0648

openshift-ci · 2025-07-01T12:37:52Z

@pperiyasamy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.20-upgrade-from-stable-4.19-e2e-azure-ovn-upgrade	`c9d43f1`	link	false	`/test 4.20-upgrade-from-stable-4.19-e2e-azure-ovn-upgrade`
ci/prow/security	`c9d43f1`	link	false	`/test security`
ci/prow/e2e-aws-hypershift-ovn-kubevirt	`c9d43f1`	link	false	`/test e2e-aws-hypershift-ovn-kubevirt`
ci/prow/4.20-upgrade-from-stable-4.19-e2e-gcp-ovn-upgrade	`c9d43f1`	link	false	`/test 4.20-upgrade-from-stable-4.19-e2e-gcp-ovn-upgrade`
ci/prow/4.20-upgrade-from-stable-4.19-e2e-aws-ovn-upgrade	`c9d43f1`	link	false	`/test 4.20-upgrade-from-stable-4.19-e2e-aws-ovn-upgrade`
ci/prow/e2e-vsphere-ovn-dualstack-primaryv6	`c9d43f1`	link	false	`/test e2e-vsphere-ovn-dualstack-primaryv6`
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp	`c9d43f1`	link	true	`/test e2e-metal-ipi-ovn-dualstack-bgp`
ci/prow/e2e-aws-ovn-upgrade-ipsec	`c9d43f1`	link	true	`/test e2e-aws-ovn-upgrade-ipsec`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

arkadeepsen

Overall looks good apart from the minor comments. Do we have e2e tests for this feature in the origin repo?

arkadeepsen · 2025-07-15T11:04:45Z

pkg/platform/platform.go

+// If the configmap doesn't exist, it returns false (the UDN isolation is protected by default).
+func isLooseUDNIsolationEnabled(client cnoclient.Client) (bool, error) {
+	configMap := &corev1.ConfigMap{}
+	if err := client.ClientFor("").CRClient().Get(context.TODO(),


Suggested change

if err := client.ClientFor("").CRClient().Get(context.TODO(),

if err := client.Default().CRClient().Get(context.TODO(),

arkadeepsen · 2025-07-15T11:05:32Z

pkg/platform/platform.go

+func isLooseUDNIsolationEnabled(client cnoclient.Client) (bool, error) {
+	configMap := &corev1.ConfigMap{}
+	if err := client.ClientFor("").CRClient().Get(context.TODO(),
+		types.NamespacedName{Name: "udn-config-overrides", Namespace: names.APPLIED_NAMESPACE}, configMap); err != nil {


Should udn-config-overrides be added as a constant? Then the constant can be used here.

I was thinking if we should go more generic with the name and use ovn-kubernetes-config-overrides and this be a more generic getOVNKConfigOverrides returning a map. Just to prevent us from spreading on config map names.

Can we just use the existing env-overrides configmap instead of creating a new configmap?

I created a new PR #2752 according to @jcaamano 's comments. PTAL.

arkadeepsen · 2025-07-15T11:12:48Z

pkg/bootstrap/types.go

 	ConsolePluginCRDExists bool
+
+	// LooseUDNIsolationModeEnabled set to true when loose isolation mode is enabled between two BGP advertised
+	// UDN networks. In loose isolation mode, those network pods can communicate with each other accoding to


Suggested change

// UDN networks. In loose isolation mode, those network pods can communicate with each other accoding to

// UDN networks. In loose isolation mode, those network pods can communicate with each other according to

nit

jcaamano · 2025-07-17T13:40:30Z

bindata/network/ovn-kubernetes/managed/ovnkube-node.yaml

+        {{ if .IsLooseUDNIsolationEnabled }}
+        - name: UDN_ISOLATION_MODE
+          value: "loose"
+        {{ end }}


I don't think this matches what ovn-kubernetes/ovn-kubernetes@3dd6149 expects. The setting there is called
ROUTED_UDN_ISOLATION instead of UDN_ISOLATION_MODE. Also the values it takes are Disabled or Enabled not loose.

This should preferably be passed as a command line argument in script-lib rather than an environment variable for consistency.

I think UDN_ISOLATION_MODE is fine, I would probably use Strict and Loose for values rather than DisabledorEnabled`.

jcaamano · 2025-07-17T13:44:46Z

pkg/platform/platform.go

+		return false, fmt.Errorf("unable to bootstrap OVN, unable to retrieve udn-config-overrides config: %s", err)
+	}
+	isLooseIsolationEnabled := configMap.Data["force-loose-isolation"]
+	return isLooseIsolationEnabled == "true", nil


Maybe just use the same key/value that we pass to ovnk for consistency? So UDNRoutedIsolationMode and Strict,Loose values? Any non expected value should return error.

jcaamano · 2025-07-17T13:51:15Z

pkg/platform/platform.go

+func isLooseUDNIsolationEnabled(client cnoclient.Client) (bool, error) {
+	configMap := &corev1.ConfigMap{}
+	if err := client.ClientFor("").CRClient().Get(context.TODO(),
+		types.NamespacedName{Name: "udn-config-overrides", Namespace: names.APPLIED_NAMESPACE}, configMap); err != nil {


I was thinking if we should go more generic with the name and use ovn-kubernetes-config-overrides and this be a more generic getOVNKConfigOverrides returning a map. Just to prevent us from spreading on config map names.

pperiyasamy · 2025-07-31T06:25:02Z

closing it in favor of #2752.

openshift-ci-robot · 2025-07-31T06:25:05Z

@pperiyasamy: This pull request references Jira Issue OCPBUGS-55962. The bug has been updated to no longer refer to the pull request using the external bug tracker.

In response to this:

This PR adds support for configuring loose isolation mode for the BGP advertised UDN networks. The config map with name openshift-network-operator/udn-config-overrides must be created with force-loose-isolation key set to true which rolls out the loose mode by recreating ovnkube-node daemonset pods.

Steps to roll out loose isolation mode:

Create a below config map.
kind: ConfigMap
apiVersion: v1
metadata:
 name: udn-config-overrides
 namespace: openshift-network-operator
data:
 force-loose-isolation: "true"
Wait for ovnkube-node DS rollout to complete.

Create BGP advertised UDN networks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot requested review from abhat and trozet May 21, 2025 17:04

pperiyasamy changed the title ~~Provide config map to force loose isolation for UDN networks~~ OCPBUGS-55962: Provide config map to force loose isolation for UDN networks May 22, 2025

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels May 22, 2025

openshift-ci bot requested a review from zhaozhanqi May 22, 2025 08:47

openshift-ci bot assigned jcaamano and kyrtapz May 22, 2025

openshift-ci bot requested a review from Meina-rh May 28, 2025 16:27

openshift-ci bot assigned anuragthehatter, jechen0648 and Meina-rh May 28, 2025

arkadeepsen reviewed Jul 15, 2025

View reviewed changes

This was referenced Jul 17, 2025

[release-4.19] BGP related backports: #2744

Closed

Bgp backports #2745

Closed

[release-4.19] BGP related backports #2746

Closed

[release-4.19] BGP related backports #2747

Closed

OCPBUGS-59645: [release-4.19] BGP related backports #2748

Merged

jcaamano reviewed Jul 17, 2025

View reviewed changes

jcaamano mentioned this pull request Jul 17, 2025

Advertised UDN pod networks isolation configurable ovn-kubernetes/ovn-kubernetes#5276

Merged

pliurh mentioned this pull request Jul 28, 2025

OCPBUGS-55962: Allow overriding OVN-Kubernetes configuration #2752

Merged

pperiyasamy closed this Jul 31, 2025

	if err := client.ClientFor("").CRClient().Get(context.TODO(),
	if err := client.Default().CRClient().Get(context.TODO(),

	// UDN networks. In loose isolation mode, those network pods can communicate with each other accoding to
	// UDN networks. In loose isolation mode, those network pods can communicate with each other according to

OCPBUGS-55962: Provide config map to force loose isolation for UDN networks #2714

OCPBUGS-55962: Provide config map to force loose isolation for UDN networks #2714

Uh oh!

Conversation

pperiyasamy commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented May 21, 2025

Uh oh!

openshift-ci-robot commented May 22, 2025

Uh oh!

pperiyasamy commented May 22, 2025

Uh oh!

pperiyasamy commented May 22, 2025

Uh oh!

pperiyasamy commented May 28, 2025

Uh oh!

openshift-ci-robot commented May 28, 2025

Uh oh!

pperiyasamy commented May 28, 2025

Uh oh!

openshift-ci bot commented Jul 1, 2025

Uh oh!

arkadeepsen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pperiyasamy commented Jul 31, 2025

Uh oh!

openshift-ci-robot commented Jul 31, 2025

Uh oh!

Uh oh!

pperiyasamy commented May 21, 2025 •

edited

Loading