Bug 1889463 - [RFE] OVN should provide a readiness indicator for a given port when all the OVS flows for the vport are installed
Summary: [RFE] OVN should provide a readiness indicator for a given port when all the ...
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux Fast Datapath
Classification: Red Hat
Component: OVN
Version: FDP 20.C
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: ---
Assignee: OVN Team
QA Contact: Jianlin Shi
Depends On:
TreeView+ depends on / blocked
Reported: 2020-10-19 17:56 UTC by Aniket Bhat
Modified: 2020-10-20 20:30 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Bugzilla 1885761 urgent ASSIGNED DNS fails to resolve in some pods 2020-12-02 08:04:20 UTC
Red Hat Bugzilla 1887585 high ASSIGNED ovn-masters stuck in crashloop after scale test 2020-12-02 08:03:11 UTC

Internal Links: 1839102

Description Aniket Bhat 2020-10-19 17:56:45 UTC
Description of problem:

Currently, there is no readiness indicator for when OVN has installed all the flows for a given pod and the pod is "provisioned" completely. 

This is particularly seen during the object density scale test, where many containers are in "Init:Error". This is because the first thing they do is try to issue a dns request to github.com and git clone. The DNS fails because we are missing flows in OVS. This is only temporary and subsequent DNS lookups work. Before we return that CNI has succeeded in ovn-k8s we need to check for the presence of flows in port security out table. A temporary fix to this is tracked by: https://bugzilla.redhat.com/show_bug.cgi?id=1885761. But we need something more long term and more reliable than checking arbitrary flow tables for entries.

What this RFE is asking for is a indicator either in the port_binding table in sbdb or in the port/interface table in OVS (as external_id or some status) that will indicate that the port is ready for use.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a pod in an openshift cluster that immediately on creating accesses the Internet
2. A few times the DNS requests made by the pod will be rejected because of a race condition between when pods make the DNS requests and when the port security flows show up

Actual results:
Pods are stuck in Init:Error state.

Expected results:
Pods are running and able to make DNS requests to the Internet.

Additional info:

Note You need to log in before you can comment on or make changes to this bug.