Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1975216

Summary:	cnf-tests fails when running on node with secure boot enabled and mlx nic
Product:	OpenShift Container Platform	Reporter:	Yuval Kashtan <ykashtan>
Component:	CNF Platform Validation	Assignee:	Sebastian Scheinkman <sscheink>
Status:	CLOSED CURRENTRELEASE	QA Contact:	elevin
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	4.8	CC:	aos-bugs, bzvonar, sscheink
Target Milestone:	---
Target Release:	4.9.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Known Issue
Doc Text:	Release Note text: Currently CNF-tests does not support secure boot with MLX NICs for SR-IOV and DPDK tests. You can run the CNF tests skipping the SR-IOV feature when running against a secure boot enabled environment in regular mode, with the `-ginkgo.skip` parameter. Running in Discovery mode is the recommended way to execute tests against a secure boot enabled environment with MLX cards. This will be resolved in a future release. ------- cnf-tests doesnt support secure boot with mlx nics at the moment, for sriov and dpdk tests	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-24 12:52:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1975708

Description Yuval Kashtan 2021-06-23 09:39:20 UTC

Description of problem:
When running cnf-tests on a node with secure boot enabled
that also have mlx nic

sriov-operator is ignoring this nic
but the tests still chooses it, which leads them to fail

Version-Release number of selected component (if applicable):


How reproducible:
every time


Steps to Reproduce:
1. enable secure boot in bios
2. run sriov tests from cnf-tests 

Actual results:
fail


Expected results:
pass

Comment 1 elevin 2021-08-08 08:38:53 UTC

Server Version: 4.8.3
Kubernetes Version: v1.21.1+051ac4f
Secure boot enabled
quay.io/openshift-kni/cnf-tests:4.9
sriov-network-operator.4.9.0-202108060405
mlnx and Intel nics

===================================================

sudo podman run  -v ~/hlx2:/kubeconfig:Z  -e KUBECONFIG=/kubeconfig/kubeconfig -e IMAGE_REGISTRY=quay.io/openshift-kni -e CNF_TESTS_IMAGE=cnf-tests:4.9 -e DPDK_TESTS_IMAGE=dpdk:4.9  -e SCTPTEST_HAS_NON_CNF_WORKERS=false quay.io/openshift-kni/cnf-tests:4.9 /usr/bin/test-run.sh -ginkgo.focus="sriov"
[sudo] password for elevin: 
running /usr/bin//validationsuite -ginkgo.focus=sriov
I0808 07:52:22.460935       7 request.go:668] Waited for 1.049114778s due to client-side throttling, not priority and fairness, request: GET:https://api.hlxcl2.lab.eng.tlv2.redhat.com:6443/apis/apps.openshift.io/v1?timeout=32s
Running Suite: CNF Features e2e validation
==========================================
Random Seed: 1628409138
Will run 6 of 36 specs

SSSSSSS•••••
------------------------------
• [SLOW TEST:7.023 seconds]
validation
/go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/validationsuite/cluster/validation.go:45
  sriov
  /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/validationsuite/cluster/validation.go:127
    should have SR-IOV node statuses not in progress
    /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/validationsuite/cluster/validation.go:193
------------------------------
SSSSSSSSSSSSSSSSSSSSSSS
Ran 6 of 36 Specs in 8.969 seconds
SUCCESS! -- 6 Passed | 0 Failed | 0 Pending | 30 Skipped
You're using deprecated Ginkgo functionality:
=============================================
Ginkgo 2.0 is under active development and will introduce (a small number of) breaking changes.
To learn more, view the migration guide at https://github.com/onsi/ginkgo/blob/v2/docs/MIGRATING_TO_V2.md
To comment, chime in at https://github.com/onsi/ginkgo/issues/711

  You are using a custom reporter.  Support for custom reporters will likely be removed in V2.  Most users were using them to generate junit or teamcity reports and this functionality will be merged into the core reporter.  In addition, Ginkgo 2.0 will support emitting a JSON-formatted report that users can then manipulate to generate custom reports.

  If this change will be impactful to you please leave a comment on https://github.com/onsi/ginkgo/issues/711
  Learn more at: https://github.com/onsi/ginkgo/blob/v2/docs/MIGRATING_TO_V2.md#removed-custom-reporters

To silence deprecations that can be silenced set the following environment variable:
  ACK_GINKGO_DEPRECATIONS=1.16.4

PASS
running /usr/bin//configsuite -ginkgo.focus=sriov
I0808 07:52:36.268691      20 request.go:668] Waited for 1.046761569s due to client-side throttling, not priority and fairness, request: GET:https://api.hlxcl2.lab.eng.tlv2.redhat.com:6443/apis/certificates.k8s.io/v1beta1?timeout=32s
Running Suite: CNF Features e2e setup
=====================================
Random Seed: 1628409153
Will run 0 of 1 specs

S
Ran 0 of 1 Specs in 0.002 seconds
SUCCESS! -- 0 Passed | 0 Failed | 0 Pending | 1 Skipped
You're using deprecated Ginkgo functionality:
=============================================
Ginkgo 2.0 is under active development and will introduce (a small number of) breaking changes.
To learn more, view the migration guide at https://github.com/onsi/ginkgo/blob/v2/docs/MIGRATING_TO_V2.md
To comment, chime in at https://github.com/onsi/ginkgo/issues/711

  You are using a custom reporter.  Support for custom reporters will likely be removed in V2.  Most users were using them to generate junit or teamcity reports and this functionality will be merged into the core reporter.  In addition, Ginkgo 2.0 will support emitting a JSON-formatted report that users can then manipulate to generate custom reports.

  If this change will be impactful to you please leave a comment on https://github.com/onsi/ginkgo/issues/711
  Learn more at: https://github.com/onsi/ginkgo/blob/v2/docs/MIGRATING_TO_V2.md#removed-custom-reporters

To silence deprecations that can be silenced set the following environment variable:
  ACK_GINKGO_DEPRECATIONS=1.16.4

PASS
running /usr/bin//cnftests -ginkgo.focus=sriov
I0808 07:52:43.858924      34 request.go:668] Waited for 1.046597701s due to client-side throttling, not priority and fairness, request: GET:https://api.hlxcl2.lab.eng.tlv2.redhat.com:6443/apis/operator.openshift.io/v1?timeout=32s
Running Suite: CNF Features e2e integration tests
=================================================
Random Seed: 1628409160
Will run 27 of 138 specs

SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
------------------------------
• [SLOW TEST:197.507 seconds]
[sriov] SCTP integration
/go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/sctp/sctp_sriov.go:33
  Test Connectivity
  /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/sctp/sctp_sriov.go:112
    Connectivity between client and server
    /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/sctp/sctp_sriov.go:113
      Should work over a SR-IOV device
      /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/sctp/sctp_sriov.go:131
------------------------------
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
------------------------------
• [SLOW TEST:1314.355 seconds]
[sriov] VRF integration
/go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/vrf/vrf_sriov.go:35
  
  /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/vrf/vrf_sriov.go:103
    Integration: SRIOV, IPAM: static, Interfaces: 1, Scheme: 2 Pods 2 VRFs OCP Primary network overlap
    /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/vrf/vrf_sriov.go:105
      {"IPStack":"ipv4"}
      /go/src/github.com/openshift-kni/cnf-features-deploy/cnf-tests/testsuites/e2esuite/vrf/vrf_sriov.go:109
------------------------------
SSSSSSSSSSSSSSSWaiting for the sriov state to stable
Sriov state is stable

------------------------------
• [SLOW TEST:53.875 seconds]
[sriov] operator
/go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:66
  No SriovNetworkNodePolicy
  /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:103
    SR-IOV network config daemon can be set by nodeselector
    /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:104
      Should schedule the config daemon on selected nodes
      /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:106
------------------------------
Waiting for the sriov state to stable
Sriov state is stable
• [SLOW TEST:39.101 seconds]
[sriov] operator
/go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:66
  Generic SriovNetworkNodePolicy
  /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:169
    Resource Injector
    /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:220
      Should inject downward api volume with no labels present
      /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:222
------------------------------
• [SLOW TEST:5.496 seconds]
[sriov] operator
/go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:66
  Generic SriovNetworkNodePolicy
  /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:169
    Resource Injector
    /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:220
      Should inject downward api volume with labels present
      /go/src/github.com/openshift-kni/cnf-features-deploy/vendor/github.com/k8snetworkplumbingwg/sriov-network-operator/test/conformance/tests/sriov_operator.go:284

Comment 3 Carlos Goncalves 2022-08-24 12:52:49 UTC

Bulk closing of all "CNF Platform Validation" component BZs assigned to CNF Network team members and in VERIFIED status for longer than 1 month.