|
1 | | -## OVN node modes and per-node feature enforcement |
| 1 | +## OVN node modes |
2 | 2 |
|
3 | | -This change introduces `OVN_NODE_MODE` as an environment variable injected into the `ovnkube-node` Pod. The value is consumed by the startup script rendered from `bindata/network/ovn-kubernetes/common/008-script-lib.yaml` to tailor behavior per node mode at runtime. |
4 | | - |
5 | | -### Why move flags from the config map into the script? |
6 | | - |
7 | | -- The INI-based config (`004-config.yaml`) is rendered cluster-wide. Those values are not reliably overridable on a per-node or per-mode basis. |
8 | | -- In DPU host mode, some features are not supported and must be deterministically disabled on those nodes even if the cluster-wide config enables them. |
9 | | -- Moving the enablement logic to the entrypoint script allows per-node enforcement using `OVN_NODE_MODE`, preventing unsupported features from being turned on by cluster defaults. |
| 3 | +The `OVN_NODE_MODE` environment variable is injected into the `ovnkube-node` Pod to identify the node's operational mode. It is consumed by the startup script rendered from `bindata/network/ovn-kubernetes/common/008-script-lib.yaml`. |
10 | 4 |
|
11 | 5 | ### Behavior by mode |
12 | 6 |
|
13 | 7 | - `full` (default): |
14 | | - - `gateway_interface=br-ex` |
| 8 | + - `gateway_interface="br-ex"` |
15 | 9 | - `init_ovnkube_controller="--init-ovnkube-controller ${K8S_NODE}"` |
16 | | - - `enable_multicast_flag="--enable-multicast"` |
17 | | - - `egress_features_enable_flag="--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true"` |
18 | | - - `multi_external_gateway_enable_flag="--enable-multi-external-gateway=true"` |
19 | 10 |
|
20 | 11 | - `dpu-host`: |
21 | | - - `gateway_interface="derive-from-mgmt-port"` |
| 12 | + - `gateway_interface="derive-from-mgmt-port"` ([ovn-kubernetes#5327](https://github.com/ovn-kubernetes/ovn-kubernetes/pull/5327)) |
22 | 13 | - `ovnkube_node_mode="--ovnkube-node-mode dpu-host"` |
23 | 14 | - `init_ovnkube_controller=""` (disabled) |
24 | | - - `enable_multicast_flag=""` (disabled) |
25 | | - - `egress_features_enable_flag=""` (egress IP and related features disabled) |
26 | | - - `multi_external_gateway_enable_flag=""` (multi-external gateway disabled) |
27 | | - - Multi-network, network segmentation, and multi-network policy/admin network policy are gated and not enabled in this mode. |
28 | | - |
29 | | -### Manifests |
30 | | - |
31 | | -- `ovnkube-node.yaml` (managed and self-hosted) now inject `OVN_NODE_MODE` into the Pod env so the script can apply mode-aware logic. |
32 | | -- `ovnkube-control-plane.yaml` (managed and self-hosted) have feature flags moved from ConfigMap to inline script logic. |
33 | | -- `004-config.yaml` drops hard-coded feature enables that conflict with per-node enforcement. |
34 | | - |
35 | | -**Note**: Control-plane components always run in "full" mode since they don't run on DPU hosts and need all features enabled for cluster coordination. Always-enabled features (egress, multicast, multi-external-gateway) are added directly to the command line, while conditional features use script variables. |
36 | | - |
37 | | -### Implementation Details |
38 | | - |
39 | | -#### Environment Variable Injection |
40 | | - |
41 | | -The `OVN_NODE_MODE` environment variable is injected into `ovnkube-node` pods through the DaemonSet specification in both managed and self-hosted variants: |
42 | | - |
43 | | -- `bindata/network/ovn-kubernetes/managed/ovnkube-node.yaml` |
44 | | -- `bindata/network/ovn-kubernetes/self-hosted/ovnkube-node.yaml` |
45 | | - |
46 | | -The value is typically derived from node labels or annotations that identify the node's hardware type. |
47 | | - |
48 | | -#### Script Logic Flow |
49 | | - |
50 | | -The startup script (`008-script-lib.yaml`) implements the following conditional logic: |
51 | | - |
52 | | -```bash |
53 | | -if [[ "${OVN_NODE_MODE}" != "dpu-host" ]]; then |
54 | | - # Enable features for full mode |
55 | | - egress_ip_enable_flag="--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true" |
56 | | - enable_multicast_flag="--enable-multicast" |
57 | | - # ... other feature flags |
58 | | -else |
59 | | - # DPU host mode - disable features |
60 | | - egress_ip_enable_flag="" |
61 | | - enable_multicast_flag="" |
62 | | - gateway_interface="derive-from-mgmt-port" |
63 | | - ovnkube_node_mode="--ovnkube-node-mode dpu-host" |
64 | | -fi |
65 | | -``` |
66 | | - |
67 | | -#### Feature Flag Mapping |
68 | | - |
69 | | -The following table shows how cluster-wide configuration translates to per-node enforcement: |
70 | | - |
71 | | -| Feature | ConfigMap (004-config.yaml) | Script Variable | DPU Host Behavior | |
72 | | -|---------|----------------------------|-----------------|-------------------| |
73 | | -| Egress IP | `enable-egress-ip=true` | `egress_features_enable_flag` | Force disabled | |
74 | | -| Multicast | `enable-multicast=true` | `enable_multicast_flag` | Force disabled | |
75 | | -| Multi External Gateway | `enable-multi-external-gateway=true` | `multi_external_gateway_enable_flag` | Force disabled | |
76 | | -| Multi-network | `enable-multi-network=true` | `multi_network_enabled_flag` | Conditionally disabled | |
77 | | -| Admin Network Policy | `enable-admin-network-policy=true` | `admin_network_policy_enabled_flag` | Conditionally disabled | |
78 | | -| Network Segmentation | `enable-network-segmentation=true` | `network_segmentation_enabled_flag` | Conditionally disabled | |
79 | | - |
80 | | -### Testing |
81 | | - |
82 | | -- Unit tests assert that the rendered script contains the correct assignments for `gateway_interface`, `init_ovnkube_controller`, `enable_multicast_flag`, `egress_features_enable_flag`, and `ovnkube_node_mode` across modes. |
83 | | -- The comprehensive test `TestOVNKubernetesScriptLibCombined` validates all conditional logic paths and feature flag assignments for node scripts. |
84 | | -- The test `TestOVNKubernetesControlPlaneFlags` validates that control-plane scripts have: |
85 | | - - Always-enabled features added directly to the command line (egress, multicast, multi-external-gateway) |
86 | | - - Conditional features handled via script variables (multi-network, network policies, etc.) |
87 | | - - Correct multi-network enablement logic (OVN_MULTI_NETWORK_ENABLE) |
88 | | -- Tests verify both positive cases (features enabled in full mode) and negative cases (features disabled in DPU host mode). |
89 | | - |
90 | | -### Migration Notes |
91 | | - |
92 | | -When upgrading clusters that previously relied on ConfigMap-based feature control: |
93 | | - |
94 | | -1. Existing ConfigMap values in `004-config.yaml` have been removed for features that require per-node control |
95 | | -2. The startup scripts (both node and control-plane) now contain the authoritative feature enablement logic |
96 | | -3. Control-plane components automatically enable all features (always run in "full" mode) |
97 | | -4. DPU host nodes will automatically have incompatible features disabled regardless of previous ConfigMap settings |
98 | | -5. No manual intervention is required - the migration is handled automatically during the upgrade process |
99 | 15 |
|
| 16 | +### Feature configuration |
100 | 17 |
|
| 18 | +Feature enablement (egress IP, multicast, multi-network, network segmentation, admin network policy, etc.) is managed through the cluster-wide ConfigMap (`004-config.yaml`) which is passed to ovnkube via `--config-file`. These features are not gated per node mode. |
0 commit comments