Repository navigation
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @ksimon1. Thanks for your PR. I'm waiting for a openshift-virtualization member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@tiraboschi can you please check this PR? |
|
@0xFelix can you please review this PR? |
|
@tiraboschi Do you have an opinion about changing this feature to opt-out in the future? I am worried about reboots which might be triggered by this feature. |
0xFelix
left a comment
0xFelix
left a comment
There was a problem hiding this comment.
Could this be an opt-out feature instead?
|
|
||
| This opt-in GA feature sets `net.vsock.child_ns_mode = local` at boot on | ||
| workers and schedulable masters (`Scheduler/cluster.spec.mastersSchedulable`). | ||
| New network namespaces use local VSOCK mode; the host stays global and existing |
There was a problem hiding this comment.
Host means the init netns, all children namespaces of the init netns will be in local mode.
| This opt-in GA feature sets `net.vsock.child_ns_mode = local` at boot on | ||
| workers and schedulable masters (`Scheduler/cluster.spec.mastersSchedulable`). | ||
| New network namespaces use local VSOCK mode; the host stays global and existing | ||
| Pod namespaces are unchanged. Custom pools selecting worker MachineConfigs |
There was a problem hiding this comment.
To me this sounds like mixing K8S and network namespaces. I'd just state that existing Pods are unaffected.
|
|
||
| - Use an OpenShift/RHCOS kernel with VSOCK support and the `child_ns_mode` | ||
| and `ns_mode` interfaces. | ||
| - Enable this feature only after upgrading CNV/KubeVirt to a version with |
There was a problem hiding this comment.
This is ds related, so just call it CNV?
| - Enable this feature only after upgrading CNV/KubeVirt to a version with | ||
| VSOCK network namespace support. | ||
|
|
||
| Autopilot does not validate these prerequisites. If affected nodes run other |
There was a problem hiding this comment.
Running it on a node/host that does not support it should result in the setting being ignored and in a fallback to global mode. Could you verify?
| needs manual removal if masters become unschedulable. | ||
|
|
||
| Complete the removal rollout and reboot affected nodes; the sysctl cannot be | ||
| switched back in place after its first write. Before downgrading KubeVirt, |
| @@ -0,0 +1 @@ | |||
| vsock | |||
There was a problem hiding this comment.
Only vsock is loaded here. Depending on the RHCOS kernel version, vhost_vsock (needed on the host side for KVM guests using autoattachVSOCK) may not be built in or auto-loaded. Can you confirm on a target kernel that loading only vsock is sufficient for the virt-launcher use case, or add vhost_vsock alongside it?
|
/ok-to-test |
Install a worker MachineConfig and a master variant when masters are schedulable. Load vsock at boot and set net.vsock.child_ns_mode=local so new child network namespaces use local mode while the host stays global. Use the existing MachineConfig CRD soft dependency and rollout flow. Administrators can opt out before rollout by excluding both MachineConfigs with platform.kubevirt.io/disabled-resources. Document kernel and CNV compatibility, reboot impact, node verification, and rollback. Add rendering, activation, and feature catalog tests, and regenerate the feature status output. Validation: focused VSOCK and root-exclusion tests, pkg/assets tests, go vet for pkg/assets and pkg/engine, asset lint, and feature-status verification pass. Full upstream CRD verification previously reported drift in the unchanged HCO and KubeVirt fixtures. Jira: https://redhat.atlassian.net/browse/CNV-98874 Assisted-by: OpenAI Codex Signed-off-by: Karel Simon <ksimon@redhat.com>
3a05f31 to
dd074b3
Compare
Add a GA feature enabled by the HyperConverged annotation
platform.kubevirt.io/enable-vsock-local=true. Configure workers and
schedulable masters to load vsock and set net.vsock.child_ns_mode=local
at boot so newly created network namespaces use local VSOCK mode.
Add rendering, activation and feature catalog tests, and regenerate
feature status output.
Assisted-by: OpenAI Codex
Signed-off-by: Karel Simon ksimon@redhat.com