Skip to content

Commit 878f96a

Browse files
ricky-ravricky-rav
committed
Add timer for Azure VIP routes reconciliation
During systemd daemon-reload (e.g., during MCO updates), the openshift-azure-routes.path unit may miss file change events from apiserver-watcher. This leaves the azure-vips nftables table empty even when the API server is back up. Fix by adding a periodic timer that triggers reconciliation every 30 seconds as a fallback. The path unit still provides immediate response to file changes. Also wrap the service ExecStart with flock to prevent concurrent executions when both triggers fire simultaneously. Reduce logging so that we do not log when there are not routes to add. This prevents the journal from getting clogged, since the service is now triggered every 30 seconds. Signed-off-by: Riccardo Ravaioli <[email protected]>
1 parent efc86f6 commit 878f96a

File tree

3 files changed

+19
-32
lines changed

3 files changed

+19
-32
lines changed

‎templates/master/00-master/azure/files/opt-libexec-openshift-azure-routes-sh.yaml‎

Lines changed: 6 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -57,15 +57,11 @@ contents:
5757
if [ -z "${ovnkContainerID}" ]; then
5858
return
5959
fi
60-
echo "Found ovnkube-controller pod... ${ovnkContainerID}"
6160
local routeVIPsV4=$(crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-list ovn_cluster_router | grep "1010" | grep "ip4" | awk '$8{print $8}')
62-
echo "Found v4route vips: ${routeVIPsV4}"
6361
local host=$(hostname)
64-
echo ${host}
6562
for route_vip in ${routeVIPsV4}; do
6663
if [[ ! -v v4vips[${route_vip}] ]] || [[ "${v4vips[${route_vip}]}" = down ]]; then
67-
echo removing stale vip "${route_vip}" for local clients
68-
echo "ovn-nbctl lr-policy-del ovn_cluster_router 1010 inport == rtos-${host} && ip4.dst == ${route_vip}"
64+
echo "removing stale route: ovn-nbctl lr-policy-del ovn_cluster_router 1010 inport == rtos-${host} && ip4.dst == ${route_vip}"
6965
crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-del ovn_cluster_router 1010 "inport == \"rtos-${host}\" && ip4.dst == ${route_vip}"
7066
fi
7167
done
@@ -75,11 +71,9 @@ contents:
7571
fi
7672
7773
local routeVIPsV6=$(crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-list ovn_cluster_router | grep "1010" | grep "ip6" | awk '$8{print $8}')
78-
echo "Found v6route vips: ${routeVIPsV6}"
7974
for route_vip in ${routeVIPsV6}; do
8075
if [[ ! -v v6vips[${route_vip}] ]] || [[ "${v6vips[${route_vip}]}" = down ]]; then
81-
echo removing stale vip "${route_vip}" for local clients
82-
echo "ovn-nbctl lr-policy-del ovn_cluster_router 1010 inport == rtos-${host} && ip6.dst == ${route_vip}"
76+
echo "removing stale route: ovn-nbctl lr-policy-del ovn_cluster_router 1010 inport == rtos-${host} && ip6.dst == ${route_vip}"
8377
crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-del ovn_cluster_router 1010 "inport == \"rtos-${host}\" && ip6.dst == ${route_vip}"
8478
fi
8579
done
@@ -101,7 +95,6 @@ contents:
10195
fi
10296
done
10397
104-
echo "synchronizing IPv4 VIPs to (${v4vipset}), IPv6 VIPS to (${v6vipset})"
10598
{
10699
echo "flush chain inet ${TABLE_NAME} ${VIPS_CHAIN}"
107100
if [[ -n "${v4vipset}" ]]; then
@@ -119,21 +112,13 @@ contents:
119112
echo "OVN-Kubernetes is not running; no routes to add."
120113
return
121114
fi
122-
echo "Found ovnkube-controller pod... ${ovnkContainerID}"
123115
local ovnK8sMp0v4=$(ip -brief address show ovn-k8s-mp0 | awk '{print $3}' | awk -F/ '{print $1}')
124-
echo "Found ovn-k8s-mp0 interface IP ${ovnK8sMp0v4}"
125116
local host=$(hostname)
126-
echo ${host}
127117
for vip in "${!v4vips[@]}"; do
128118
if [[ "${v4vips[${vip}]}" != down ]]; then
129-
echo "ensuring route for ${vip} for internal clients"
130119
local routes=$(crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-list ovn_cluster_router | grep "1010" | grep "${vip}" | grep "${ovnK8sMp0v4}")
131-
echo "OVNK Routes on ovn-cluster-router at 1010 priority: $routes"
132-
if [[ "${routes}" == *"${vip}"* ]]; then
133-
echo "Route exists"
134-
else
135-
echo "Route does not exist; creating it..."
136-
echo "ovn-nbctl lr-policy-add ovn_cluster_router 1010 inport == rtos-${host} && ip4.dst == ${vip} reroute ${ovnK8sMp0v4}"
120+
if [[ "${routes}" != *"${vip}"* ]]; then
121+
echo "adding route: ovn-nbctl lr-policy-add ovn_cluster_router 1010 inport == rtos-${host} && ip4.dst == ${vip} reroute ${ovnK8sMp0v4}"
137122
crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-add ovn_cluster_router 1010 "inport == \"rtos-${host}\" && ip4.dst == ${vip}" reroute "${ovnK8sMp0v4}"
138123
fi
139124
fi
@@ -144,18 +129,11 @@ contents:
144129
fi
145130
146131
local ovnK8sMp0v6=$(ip -brief address show ovn-k8s-mp0 | awk '{print $4}' | awk -F/ '{print $1}')
147-
echo "Found ovn-k8s-mp0 interface IP ${ovnK8sMp0v6}"
148-
149132
for vip in "${!v6vips[@]}"; do
150133
if [[ "${v6vips[${vip}]}" != down ]]; then
151-
echo "ensuring route for ${vip} for internal clients"
152134
local routes=$(crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-list ovn_cluster_router | grep "1010" | grep "${vip}" | grep "${ovnK8sMp0v6}")
153-
echo "OVNK Routes on ovn-cluster-router at 1010 priority: $routes"
154-
if [[ "${routes}" == *"${vip}"* ]]; then
155-
echo "Route exists"
156-
else
157-
echo "Route does not exist; creating it..."
158-
echo "ovn-nbctl lr-policy-add ovn_cluster_router 1010 inport == rtos-${host} && ip6.dst == ${vip} reroute ${ovnK8sMp0v6}"
135+
if [[ "${routes}" != *"${vip}"* ]]; then
136+
echo "adding route: ovn-nbctl lr-policy-add ovn_cluster_router 1010 inport == rtos-${host} && ip6.dst == ${vip} reroute ${ovnK8sMp0v6}"
159137
crictl exec -i ${ovnkContainerID} ovn-nbctl lr-policy-add ovn_cluster_router 1010 "inport == \"rtos-${host}\" && ip6.dst == ${vip}" reroute "${ovnK8sMp0v6}"
160138
fi
161139
fi
@@ -195,10 +173,8 @@ contents:
195173
echo "${vip} has upfile and downfile, marking as down"
196174
else
197175
if [[ ${vip} =~ : ]]; then
198-
echo "processing v6 vip ${vip}"
199176
v6vips[${vip}]="${vip}"
200177
else
201-
echo "processing v4 vip ${vip}"
202178
v4vips[${vip}]="${vip}"
203179
fi
204180
fi
@@ -213,7 +189,6 @@ contents:
213189
sync_rules
214190
remove_stale_routes # needed for OVN-Kubernetes plugin's routingViaHost=false mode
215191
add_routes # needed for OVN-Kubernetes plugin's routingViaHost=false mode
216-
echo "done applying vip rules"
217192
;;
218193
cleanup)
219194
clear_rules

‎templates/master/00-master/azure/units/openshift-azure-routes.service.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@ contents: |
88
99
[Service]
1010
Type=simple
11-
ExecStart=/bin/bash /opt/libexec/openshift-azure-routes.sh start
11+
ExecStart=/usr/bin/flock --exclusive --nonblock /run/azure-routes.lock /bin/bash /opt/libexec/openshift-azure-routes.sh start
1212
User=root
1313
SyslogIdentifier=openshift-azure-routes

‎templates/master/00-master/azure/units/openshift-azure-routes.timer.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: openshift-azure-routes.timer
2+
enabled: true
3+
contents: |
4+
[Unit]
5+
Description=Periodic reconciliation of Azure VIP routes
6+
7+
[Timer]
8+
OnBootSec=30
9+
OnUnitActiveSec=30
10+
11+
[Install]
12+
WantedBy=timers.target

0 commit comments

Comments
 (0)